computer science

SPNEGO

SPNEGO is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand SPNEGO rather than just read about it. In short: Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO), often pronounced "spenay-go", is a GSSAPI "pseudo mechanism" used by client-server software to negotiate the choice of security technology. SPNEGO is used when a client application wants to authenticate to a remote server, but neither end is sure what authentication protocols the other supports.

Key takeaways

SPNEGO belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect SPNEGO to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of SPNEGO from memory before moving on to harder problems.

Reference excerpt

Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO), often pronounced "spenay-go", is a GSSAPI "pseudo mechanism" used by client-server software to negotiate the choice of security technology. SPNEGO is used when a client application wants to authenticate to a remote server, but neither end is sure what authentication protocols the other supports. The pseudo-mechanism uses a protocol to determine what common GSSAPI mechanisms are available, selects one and then dispatches all further security operations to it. This can help organizations deploy new security mechanisms in a phased manner. SPNEGO's most visible use is in Microsoft's "HTTP Negotiate" authentication extension. It was first implemented in Internet Explorer 5.01 and IIS 5.0 and provided single sign-on capability later marketed as Integrated Windows Authentication. The negotiable sub-mechanisms included NTLM and Kerberos, both used in Active Directory. The HTTP Negotiate extension was later implemented with similar support in:

Mozilla 1.7 beta Mozilla Firefox 0.9 Konqueror 3.3.1 Google Chrome 6.0.472

History 19 February 1996 – Eric Baize and Denis Pinkas publish the Internet Draft Simple GSS-API Negotiation Mechanism (draft-ietf-cat-snego-01.txt). 17 October 1996 – The mechanism is assigned the object identifier 1.3.6.1.5.5.2 and is abbreviated snego. 25 March 1997 – Optimistic piggybacking of one mechanism's initial token is added. This saves a round trip. 22 April 1997 – The "preferred" mechanism concept is introduced. The draft standard's name is changed from just "Simple" to "Simple and Protected" (spnego). 16 May 1997 – Context flags are added (delegation, mutual auth, etc.). Defenses are provided against attacks on the new "preferred" mechanism. 22 July 1997 – More context flags are added (integrity and confidentiality). 18 November 1998 – The rules of selecting the common mechanism are relaxed. Mechanism preference is integrated into the mechanism list. 4 March 1998 – An optimisation is made for an odd number of exchanges. The mechanism list itself is made optional. December 1998 (Final) – DER encoding is chosen to disambiguate how the MIC is calculated. The draft is submitted for standardisation as RFC 2478. October 2005 – Interoperability with Microsoft implementations is addressed. Some constraints are improved and clarified and defects corrected. Published as RFC 4178, although it is now non-interoperable with strict implementations of now-obsoleted RFC 2478.

Notes

References "Internet Drafts of RFC 4178". All (Current & Expired) Internet Drafts Collection – Drafts. Retrieved 23 August 2014. "HTTP-Based Cross-Platform Authentication via the Negotiate Protocol". Microsoft Developer Network (MSDN) library. Retrieved 8 October 2015. "using mod_auth_kerb and Windows 2000/2003 as KDC". Tutorial. Retrieved 2 December 2005.

External links RFC 4178 The Simple and Protected GSS-API Negotiation Mechanism (obsoletes RFC 2478). RFC 4559 SPNEGO-based Kerberos and NTLM HTTP Authentication in Microsoft Windows

Worked examples

Example 1 — a first encounter with SPNEGO

Start with the simplest possible case. Write down what SPNEGO claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to SPNEGO before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about SPNEGO ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of SPNEGO

In research: SPNEGO appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses SPNEGO in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: SPNEGO is common in secondary-school and first-year university syllabi. It links to neighbouring topics Computer access control protocols, Cryptographic protocols, so understanding it makes those chapters shorter.
In everyday life: Look for SPNEGO outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study SPNEGO in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what SPNEGO means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain SPNEGO out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is SPNEGO in simple terms?

Why does SPNEGO matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study SPNEGO?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on SPNEGO.