biology

Generic Security Services Application Programming Interface

Generic Security Services Application Programming Interface is a biology topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Generic Security Services Application Programming Interface rather than just read about it. In short: The Generic Security Service Application Programming Interface (GSSAPI, also GSS-API) is an application programming interface for programs to access security services. The GSSAPI is an IETF standard that addresses the problem of many similar but incompatible security services in use as of 2005.

Key takeaways

Generic Security Services Application Programming Interface belongs to biology; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Generic Security Services Application Programming Interface to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Generic Security Services Application Programming Interface from memory before moving on to harder problems.

Reference excerpt

The Generic Security Service Application Programming Interface (GSSAPI, also GSS-API) is an application programming interface for programs to access security services. The GSSAPI is an IETF standard that addresses the problem of many similar but incompatible security services in use as of 2005.

Operation The GSSAPI, by itself, does not provide any security. Instead, security-service vendors provide GSSAPI implementations - usually in the form of libraries installed with their security software. These libraries present a GSSAPI-compatible interface to application writers who can write their application to use only the vendor-independent GSSAPI. If the security implementation ever needs replacing, the application need not be rewritten. The definitive feature of GSSAPI applications is the exchange of opaque messages (tokens) which hide the implementation detail from the higher-level application. The client and server sides of the application are written to convey the tokens given to them by their respective GSSAPI implementations. GSSAPI tokens can usually travel over an insecure network as the mechanisms provide inherent message security. After the exchange of some number of tokens, the GSSAPI implementations at both ends inform their local application that a security context is established. Once a security context is established, sensitive application messages can be wrapped (encrypted) by the GSSAPI for secure communication between client and server. Typical protections guaranteed by GSSAPI wrapping include confidentiality (secrecy) and integrity (authenticity). The GSSAPI can also provide local guarantees about the identity of the remote user or remote host. The GSSAPI describes about 45 procedure calls. Significant ones include:

GSS_Acquire_cred Obtains the user's identity proof, often a secret cryptographic key GSS_Import_name Converts a username or hostname into a form that identifies a security entity GSS_Init_sec_context Generates a client token to send to the server, usually a challenge GSS_Accept_sec_context Processes a token from GSS_Init_sec_context and can generate a response token to return GSS_Wrap Converts application data into a secure message token (typically encrypted) GSS_Unwrap Converts a secure message token back into application data The GSSAPI is standardized for the C (RFC 2744) language. Java implements the GSSAPI as JGSS, the Java Generic Security Services Application Program Interface. Some limitations of GSSAPI are:

standardizing only authentication, rather not authorization too; assuming a client–server architecture. Anticipating new security mechanisms, the GSSAPI includes a negotiating pseudo mechanism, SPNEGO, that can discover and use new mechanisms not present when the original application was built.

Availability Various languages implement the GSSAPI. Java provides these features in its standard library package org.ietf.jgss.*.

Relationship to Kerberos The dominant GSSAPI mechanism implementation in use is Kerberos. Unlike the GSSAPI, the Kerberos API has not been standardized and various existing implementations use incompatible APIs. The GSSAPI allows Kerberos implementations to be API compatible.

Related technologies RADIUS SASL TLS SSPI SPNEGO RPCSEC GSS

Key concepts Name A binary string that labels a security principal (i.e., user or service program) - see access control and identity. For example, Kerberos uses names like user@REALM for users and service/hostname@REALM for programs. Credentials Information that proves an identity; used by an entity to act as the named principal. Credentials typically involve a secret cryptographic key. Context The state of one end of the authenticating/authenticated protocol. May provide message protection services, which can be used to compose a secure channel. Tokens Opaque messages exchanged either as part of the initial authentication protocol (context-level tokens), or as part of a protected communication (per-message tokens) Mechanism An underlying GSSAPI implementation that provides actual names, tokens and credentials. Known mechanisms include Kerberos, NTLM, Distributed Computing Environment (DCE), SESAME, SPKM, LIPKEY. Initiator/acceptor The peer that sends the first token is the initiator; the other is the acceptor. Generally, the client program is the initiator while the server is the acceptor.

History July 1991: IETF Common Authentication Technology (CAT) Working Group meets in Atlanta, led by John Linn September 1993: GSSAPI version 1 (RFC 1508, RFC 1509) May 1995: Windows NT 3.51 released, includes SSPI June 1996: Kerberos mechanism for GSSAPI (RFC 1964) January 1997: GSSAPI version 2 (RFC 2078) October 1997: SASL published, includes GSSAPI mechanism (RFC 2222) January 2000: GSSAPI version 2 update 1 (RFC 2743, RFC 2744) August 2004: KITTEN working group meets to continue CAT activities May 2006: Secure Shell use of GSSAPI standardised (RFC 4462)

Worked examples

Example 1 — a first encounter with Generic Security Services Application Programming Interface

Start with the simplest possible case. Write down what Generic Security Services Application Programming Interface claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In biology, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Generic Security Services Application Programming Interface before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Generic Security Services Application Programming Interface ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Generic Security Services Application Programming Interface

In research: Generic Security Services Application Programming Interface appears in biology research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Generic Security Services Application Programming Interface in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Generic Security Services Application Programming Interface is common in secondary-school and first-year university syllabi. It links to neighbouring topics Internet Standards, Operating system security, so understanding it makes those chapters shorter.
In everyday life: Look for Generic Security Services Application Programming Interface outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Generic Security Services Application Programming Interface in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Generic Security Services Application Programming Interface means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Generic Security Services Application Programming Interface out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Generic Security Services Application Programming Interface in simple terms?

Why does Generic Security Services Application Programming Interface matter?

Because it connects several biology ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Generic Security Services Application Programming Interface?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Generic Security Services Application Programming Interface.