RFC 6680

Generic Security Service Application Programming Interface (GSS-API) Naming Extensions

📅 published August 2012, from ietf

RFC 6680: GSS-API Naming Extensions ✨

Generic Security Service Application Programming Interface (GSS-API) Naming Extensions 🎀

Okay bestie, here's the title block 💅 It's RFC 6680, published in August 2012 by the IETF. The authors are N. Williams (Cryptonector, LLC), L. Johansson (SUNET), S. Hartman (Painless Security), and S. Josefsson (SJD AB). It's a Standards Track document, with ISSN 2070-1721. The title block doesn't list anything it obsoletes or updates, so there's nothing to flag there 🌸

Abstract 🦋

GSS-API gives you a simple naming setup for name-based authorization, and this doc adds new APIs that extend that naming model so name attributes can be transferred between GSS-API peers. It's giving upgrade energy 🔥

Status of This Memo ✨

This is an Internet Standards Track document 💜

It's a product of the IETF, so it represents the consensus of the IETF community. It went through public review and got approved for publication by the IESG. More info on Internet Standards is in Section 2 of RFC 5741 🌈

You can find the current status, any errata, and how to send feedback at http://www.rfc-editor.org/info/rfc6680 🧚

Copyright Notice 🎀

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document 🙈 Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 📜

This document may include material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The people controlling the copyright in some of that material may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process. Unless you get an adequate license from those copyright holders, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process. The exceptions are formatting it for publication as an RFC or translating it into languages other than English 🫶

Table of Contents 🍓

1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
2.  Conventions Used in This Document  . . . . . . . . . . . . . .  3
3.  Name Attribute Authenticity  . . . . . . . . . . . . . . . . .  4
4.  Name Attributes/Values as ACL Subjects . . . . . . . . . . . .  4
5.  Naming Contexts  . . . . . . . . . . . . . . . . . . . . . . .  4
6.  Representation of Attribute Names  . . . . . . . . . . . . . .  6
7.  API  . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  7
  7.1.  SET OF OCTET STRING  . . . . . . . . . . . . . . . . . . .  7
  7.2.  Const Types  . . . . . . . . . . . . . . . . . . . . . . .  8
  7.3.  GSS_Display_name_ext() . . . . . . . . . . . . . . . . . .  8
    7.3.1.  C-Bindings . . . . . . . . . . . . . . . . . . . . . .  9
  7.4.  GSS_Inquire_name() . . . . . . . . . . . . . . . . . . . .  9
    7.4.1.  C-Bindings . . . . . . . . . . . . . . . . . . . . . . 10
  7.5.  GSS_Get_name_attribute() . . . . . . . . . . . . . . . . . 10
    7.5.1.  C-Bindings . . . . . . . . . . . . . . . . . . . . . . 11
  7.6.  GSS_Set_name_attribute() . . . . . . . . . . . . . . . . . 12
    7.6.1.  C-Bindings . . . . . . . . . . . . . . . . . . . . . . 13
  7.7.  GSS_Delete_name_attribute()  . . . . . . . . . . . . . . . 14
    7.7.1.  C-Bindings . . . . . . . . . . . . . . . . . . . . . . 14
  7.8.  GSS_Export_name_composite()  . . . . . . . . . . . . . . . 14
    7.8.1.  C-Bindings . . . . . . . . . . . . . . . . . . . . . . 15
8.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 15
9.  Security Considerations  . . . . . . . . . . . . . . . . . . . 16
10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 17
  10.1. Normative References . . . . . . . . . . . . . . . . . . . 17
  10.2. Informative References . . . . . . . . . . . . . . . . . . 17

1. Introduction ✨

Okay so, as described in [RFC4768], GSS-API's naming architecture has some limitations. This document is here to overcome them 🦋

It describes a bunch of extensions to the GSS-API [RFC2743] and its C-bindings [RFC2744]. The big goal is to make information modeled as "name attributes" available to applications. This info MAY, for instance, be used by applications to make authorization decisions. Like, Kerberos V authorization data elements, both raw and mapped to more useful value types, can be made available to GSS-API applications through these interfaces. It's giving main character energy 👑

Here's the model: GSS names have attributes. An attribute can be authenticated (for example, an X509 attribute certificate or a signed Security Assertion Markup Language (SAML) attribute assertion). Or it can have been set on a GSS name so it's "asserted" locally during credential acquisition or security context exchange. The values of name attributes are network representations of them (like the actual value octets of an X.509 certificate extension, for example). They're meant to be useful for building portable access control facilities 💅 Apps often need language- or platform-specific data types instead of network representations, so there's a function to get objects of those types for names and name attributes 🌸

Future updates might add an attribute namespace for attributes that only have application-specific semantics. Mechanisms will still need to know how to transport those attributes, though 🫶 The IETF might also want functions to ask whether a mechanism understands a given attribute name or namespace, and to list which attributes or attribute namespaces a mechanism understands. Finally, the IETF may want to think about adding a function that finds the name of the issuer of a name attribute 👀

2. Conventions Used in This Document 📜

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 💜

3. Name Attribute Authenticity 🔥

An attribute is "authenticated" if and only if there's a secure association between the attribute (and its values) and the trusted source of the peer credential. Examples of authenticated attributes are (any part of) the signed portion of an X.509 certificate, or AD-KDCIssued authorization data elements (Section 5.2.6.2 of [RFC4120]) in Kerberos V Tickets. That's provided, of course, that the authenticity of the respective security associations (e.g., signatures) has been verified 🔐

Note that an attribute being authenticated doesn't tell you anything about its semantics, and it doesn't mean the trusted credential source was authorized to assert it. Those interpretations SHOULD come from applying local policy to the attribute 🙅‍♀️

An unauthenticated attribute gets called _asserted_ from here on. Don't mix this up with other uses of "asserted" or "assertion," like "SAML attribute assertion." The attributes of one of those may be authenticated in the sense of this document, for instance, if the SAML attribute assertion was signed by a key the peer trusts 🦋

4. Name Attributes/Values as ACL Subjects 🎀

To make portable apps that use name attributes to build and evaluate portable Access Control Lists (ACLs) easier to develop, the GSS-API makes name attribute values available in their canonical network encodings 🧚

More parts follow, so stay tuned 🌈💖

5. Naming Contexts ✨

Okay so a name attribute's vibe depends on its context, and there are a few things that shape it 💅

The first is the trust context. Like we talked about earlier, apps use local policy to decide whether a certain credential issuer is trusted to make a given statement. Different GSS-API mechanisms and deployments have totally different trust models for the attributes they hand out about a name 🧚

For example, enterprise Kerberos deployments usually trust the Key Distribution Center (KDC) to say anything about principals in a realm. That includes stuff like group membership 🔐

Now compare that to a federated SAML setup, where the identity provider usually lives in a different org from the acceptor. There, the group memberships or entitlements the IDP can assert get filtered by the acceptor's policy and the federation's policy. Not everything goes through, bestie 🙅‍♀️

So even if two attributes hold the exact same info, like an email address, the app has to treat them differently depending on whether it's in an enterprise or a federation. Main character energy for context-awareness 👑

Trust also depends on who issued the attribute. Take Public Key Cryptography for Initial Authentication in Kerberos (PKINIT) [RFC4556]. In PKINIT, a public key and its certificate are used to authenticate to a Kerberos KDC. So how should attributes tied to a PKINIT certificate show up in GSS-API authentications based on the Kerberos ticket? 🤔

It depends on the deployment. In some, the certificate is fully trusted. By putting the certificate info in the ticket, the KDC lets the acceptor trust what's in the certificate as if the KDC had said it itself 🫶

In other deployments, the KDC may only have authorized a hash of the certificate. It never checked the contents or really trusted the issuing certification authority. If the certificate got included in the ticket anyway, the KDC would only be saying "this certificate was used in the authentication." That statement is authenticated, but it doesn't mean the KDC vouches for the certificate's attributes describing the initiator accurately 😭

Encoding is another part of context. An attribute holding an ASCII [ANSI.X3-4.1986] or UTF-8 [RFC3629] version of an email address can't be read the same way as an ASN.1 Distinguished Encoding Rules email address inside a certificate. Same vibe, different wrapping 🎀

Put all of these contextual pieces together and you get the answer to whether two attributes can be treated as the same by an app, and so whether they should count as the same name attribute 🦋

Here's the rule: in the GSS-API naming extensions, attributes with different contexts MUST have different names so applications can tell them apart. The unfortunate side effect is that multiple attribute names will exist for the same basic info. There isn't one single attribute name for an initiator's email address, sorry bestie 🙈 Mechanisms already make this true anyway. Some use OIDs to name attributes, others use URIs.

Local implementations or platforms usually have enough policy and info to know when two contexts can be treated as the same. For instance, the GSS-API implementation might know a particular certification authority is trusted in a PKINIT authentication. It might also know that a particular credential issuer is trusted to make a given statement 🧠

To use that local knowledge inside the GSS-API implementation, the naming extensions support local attributes alongside standard attributes. For example, an implementation could provide a local attribute for email address. That implementation would define the encoding and representation of the attribute, and mechanism-specific standard attributes would get re-encoded if needed to match that representation. Only email addresses from contexts that meet the local policy's requirements would be mapped into this local attribute ✨

Local attributes come with a trade-off between interoperability and usability. Using a local attribute in an app means you need to know the local implementation. Using a standard attribute means the app needs more policy knowledge and more validation logic. Putting that logic in the local platform gives you more consistency across apps and lowers implementation costs. Both options are needed, periodt 💖

6. Representation of Attribute Names 🌸

Different underlying mechanisms, like SAML or X.509 certificates, represent their attribute names differently. In X.509 certificates, most objects are named by object identifiers (OIDs). The type of object (certificate extension, name constraint, keyPurposeID, and so on) plus the OID is enough to identify the attribute 🔍

SAML is different. According to Sections 8.2 and 2.7.3.1 of [OASIS.saml-core-2.0-os], an attribute name has two parts. The first is a URI describing the format of the name. The second part, whose form depends on the format URI, is the actual name. Other times, an attribute might represent a certificate that plays a certain role in a GSS-API mechanism, and those attributes might just have a simple mechanism-defined name 🦋

Attribute names MUST support multiple components. When there's more than one component, the more significant components define the semantics of the less significant ones. It's like a little hierarchy, iykyk 👑

Attribute names are represented as OCTET STRING elements in the API described below. Their syntax and semantics are understood by both the application and the lower-layer implementations (some of which get described below) 🧚

Here's the splitting rule. If an attribute name contains a space (ASCII 0x20), the first space separates the most significant or primary component from everything after it. We may refer to the primary component as the attribute name's "prefix". If there's no space, the primary component is the entire name. Otherwise, the primary component defines how to interpret the remainder of the name 💅

If the primary component contains a ":" (ASCII 0x3a), then the primary component is a URI. Otherwise, the attribute is a local attribute, and its primary component only has meaning to the GSS-API implementation or to the application's specific configuration. Local attribute names with an "at" sign ("@") in them are reserved for future allocation by the IETF 🔒

Because attribute names get split at the first space into prefix and suffix, there's a potential for ambiguity if a mechanism blindly passes through a name attribute whose name it doesn't understand. To avoid those ambiguities, the mechanism MUST always prefix raw name attributes with a prefix that reflects the attribute's context 🎀

Local attribute names under the control of an administrator, or a sufficiently trusted part of the platform, don't need a prefix to describe their context. They're already trusted, so no need to over-explain 🫶

7. API 🌈

7.1. SET OF OCTET STRING

The construct "SET OF OCTET STRING" shows up once in RFC 2743 [RFC2743], where it represents a set of status strings in the GSS_Display_status call. The Global Grid Forum defined SET OF OCTET STRING as a buffer set type in GFD.024 [GFD.024], which also offers one API for memory management of these structures 🍓

The normative reference to GFD.024 [GFD.024] is only for the buffer set functions defined in Section 2.5 and the associated buffer set C types defined in Section 6. Those are gss_buffer_set_desc, gss_buffer_set_t, gss_create_empty_buffer_set, gss_add_buffer_set_member, and gss_release_buffer_set. Nothing else from GFD.024 is required to implement this document. Also, that document specifies changes to how some existing GSS-API functions behave in Section 3, and implementing those changes is not required to implement this document 💜

Any implementation of SET OF OCTET STRING used by this specification MUST preserve order ⭐

7.2. Const Types

The C-bindings for the new APIs use some types from [RFC5587] to avoid issues with the use of "const" 🧚 The normative reference to [RFC5587] is only for the C types specified in Figure 1 of Section 3.4.6. Nothing else from that document is required to implement this document 🦋

7.3. GSS_Display_name_ext()

Inputs:

name INTERNAL NAME
display_as_name_type OBJECT IDENTIFIER

Outputs:

major_status INTEGER
minor_status INTEGER
display_name OCTET STRING -- caller must release with GSS_Release_buffer()

Return major_status codes:

GSS_S_COMPLETE indicates no error.
GSS_S_UNAVAILABLE indicates that the given name could not be displayed using the syntax of the given name type.
GSS_S_FAILURE indicates a general error.

This function displays a given name using the given name syntax, if it's possible. This operation may need to map Mechanism Names (MNs) to generic name syntaxes, or generic name syntaxes to mechanism-specific name syntaxes. Those mappings aren't always feasible and MAY be inexact or lossy, so this function may fail. Not every glow-up works out 🥲

7.3.1. C-Bindings

The display_name buffer is de-allocated by the caller with gss_release_buffer. 🎀

OM_uint32 gss_display_name_ext(
  OM_uint32                     *minor_status,
  gss_const_name_t              name,
  gss_const_OID                 display_as_name_type,
  gss_buffer_t                  display_name
);

7.4. GSS_Inquire_name()

Inputs:

name INTERNAL NAME

Outputs:

major_status INTEGER
minor_status INTEGER
name_is_MN BOOLEAN
mn_mech OBJECT IDENTIFIER
attrs SET OF OCTET STRING -- the caller is responsible for de-allocating memory using GSS_Release_buffer_set

Return major_status codes:

GSS_S_COMPLETE indicates no error.
GSS_S_FAILURE indicates a general error.

This function outputs the set of attributes of a name. It also indicates whether a given name is a Mechanism Name (MN) and, if it is, which mechanism it's an MN for 🔥

7.4.1. C-Bindings

OM_uint32 gss_inquire_name(
  OM_uint32                     *minor_status,
  gss_const_name_t              name,
  int                           *name_is_MN,
  gss_OID                       *MN_mech,
  gss_buffer_set_t              *attrs
);

The gss_buffer_set_t is used here as the C representation of SET OF OCTET STRING. This type represents a set of attributes and is a NULL-terminated array of gss_buffer_t. The gss_buffer_set_t type and its associated API are defined in GFD.024 [GFD.024]. The "attrs" buffer set is de-allocated by the caller using gss_release_buffer_set(). 💖

7.5. GSS_Get_name_attribute() 💅

okay so this is the getter, bestie 🎀 you give it a name object and an attribute, and it hands back the values for that attribute 🦋

Inputs:

name INTERNAL NAME
attr OCTET STRING

Outputs:

major_status INTEGER
minor_status INTEGER
authenticated BOOLEAN, which is TRUE if and only if a trusted peer credential source authenticated it 🔐
complete BOOLEAN, which is TRUE if and only if this is a complete set of values for the name 🧩
values SET OF OCTET STRING, where the caller is responsible for de-allocating memory using GSS_Release_buffer_set 🧹
display_values SET OF OCTET STRING, where the caller is responsible for de-allocating memory using GSS_Release_buffer_set 🧹

Return major_status codes:

GSS_S_COMPLETE means no error ✨
GSS_S_UNAVAILABLE means the attribute OID isn't known or set 🙈
GSS_S_FAILURE means a general error 💀

This function spits out the value(s) tied to a GSS name object for one name attribute. Iconic. 👑

The complete flag, when TRUE, says the set of values is the whole set for this name. If the peer is an authoritative source for the attribute, that's enough for the peer to set the complete flag 💖

Now, in the federated case, where a bunch of peers might each hold some of the attributes about a name, this flag can be highly dangerous, so it SHOULD NOT be used 🚨

NOTE: This function counts on GSS-API's "SET OF" keeping the order of things. This came up on the KITTEN WG mailing list, and the vibe there was that yes, that was always the plan 🤓 Just be aware that the order you see doesn't always match the order of the values in the mechanism-specific source of the attribute. 🫶

7.5.1. C-Bindings

The C-bindings of GSS_Get_name_attribute() need one function call per attribute value for multi-valued name attributes 📞 Each value goes into its own gss_buffer_t, and an input/output integer parameter tells you whether it's the first call, a later call, or the last one 🎯

The "more" input/output parameter should point to an integer. On the first call to gss_get_name_attribute() it MUST be -1. When the call returns, it's non-zero if more values are left and zero if none are left 🌸 The caller shouldn't touch this parameter after that first call. The complete and authenticated flags MUST NOT change between calls while you're looping over an attribute's values 😤

The output buffers "value" and "display_value" get de-allocated by the caller using gss_release_buffer() 🧼

OM_uint32 gss_get_name_attribute(
  OM_uint32                     *minor_status,
  gss_const_name_t              name,
  gss_const_buffer_t            attr,
  int                           *authenticated,
  int                           *complete,
  gss_buffer_t                  value,
  gss_buffer_t                  display_value,
  int                           *more
);

7.6. GSS_Set_name_attribute() 🪄

Inputs:

name INTERNAL NAME
complete BOOLEAN, which is TRUE if and only if this is a complete set of values for the name 🧩
attr OCTET STRING
values SET OF OCTET STRING

Outputs:

major_status INTEGER
minor_status INTEGER

Return major_status codes:

GSS_S_COMPLETE means no error ✨
GSS_S_UNAVAILABLE means the attribute NAME isn't known or couldn't be set 🙈
GSS_S_FAILURE means a general error 💀

When the NAME object is an MN, this function MUST fail (with GSS_S_FAILURE) if the mechanism the name is an MN for doesn't recognize the attribute name or the namespace it belongs to 🚫 That's because name attributes usually have semantics the mechanisms have to understand, so no vibes-only attributes here 💅

On the other hand, when the name is not an MN, this function MAY succeed even if none of the available mechanisms understand the attribute. But later credential acquisition attempts (via GSS_Acquire_cred() or GSS_Add_cred()) with that name MUST fail for any mechanism that doesn't understand one or more of the name attributes set with this function. Apps might want to use a non-MN, then acquire a credential with that name as the desired name. The acquired credentials will only have elements for the mechanisms that can carry the name attributes set on the name 🦋

So basically, every name attribute is locally critical: the mechanism(s) must understand them 🔥 The reason is that name attributes must have some meaning the mechanism understands, even application-specific ones (and then the mechanism has to know to carry the attribute to any peer). But there's no guarantee peers understand a given attribute 🥲 Individual attributes might be critical to peers too, and the attribute's spec will have to say whether the mechanism's protocol or the application is supposed to enforce that criticality 🧚

Again in the federated case, when several peers may hold some of the attributes about a name, this flag may be highly dangerous and SHOULD NOT be used 🚨

NOTE: This function counts on GSS-API's "SET OF" keeping order. The KITTEN WG mailing list talked about it, and the consensus was that yes, that was always the intention 🤓 Still, underlying mechanisms may not respect the order you give them. 🫶

7.6.1. C-Bindings

The C-bindings of GSS_Set_name_attribute() need one function call per attribute value for multi-valued name attributes. Each call adds one value. If you want to replace every value an attribute has, delete the attribute's values first with GSS_Delete_name_attribute() 🧹

OM_uint32 gss_set_name_attribute(
  OM_uint32                     *minor_status,
  gss_const_name_t              name,
  int                           complete,
  gss_const_buffer_t            attr,
  gss_const_buffer_t            value
);

7.7. GSS_Delete_name_attribute() 🗑️

Inputs:

name INTERNAL NAME
attr OCTET STRING

Outputs:

major_status INTEGER
minor_status INTEGER

Return major_status codes:

GSS_S_COMPLETE means no error ✨
GSS_S_UNAVAILABLE means the attribute NAME isn't known 🙈
GSS_S_UNAUTHORIZED means a forbidden delete was attempted, like deleting a negative attribute 🚷
GSS_S_FAILURE means a general error 💀

Deleting negative authenticated attributes from NAME objects MUST NOT be allowed, and trying it must result in a GSS_S_UNAUTHORIZED 🙅‍♀️

7.7.1. C-Bindings

OM_uint32 gss_delete_name_attribute(
  OM_uint32                     *minor_status,
  gss_const_name_t              name,
  gss_const_buffer_t            attr
);

7.8. GSS_Export_name_composite() 📦

Inputs:

name INTERNAL NAME

Outputs:

major_status INTEGER
minor_status INTEGER
exp_composite_name OCTET STRING, where the caller is responsible for de-allocating memory using GSS_Release_buffer 🧹

Return major_status codes:

GSS_S_COMPLETE means no error ✨
GSS_S_FAILURE means a general error 💀

This function outputs a token you can import with GSS_Import_name(), using GSS_C_NT_COMPOSITE_EXPORT as the name type 🎁 The token keeps any name attribute info (including the authenticated/complete flags) tied to the input name, which GSS_Export_name() might not do. The token format isn't specified here, since this is only meant for inter-process communication 🫶 Still, every one of these tokens MUST start with a two-octet token ID, hex 04 02, in network byte order 🔢

The OID for GSS_C_NT_COMPOSITE_EXPORT is 1.3.6.1.5.6.6.

7.8.1. C-Bindings

The "exp_composite_name" buffer is de-allocated by the caller with gss_release_buffer 🧼

OM_uint32 gss_export_name_composite(
  OM_uint32                     *minor_status,
  gss_const_name_t              name,
  gss_buffer_t                  exp_composite_name
);

8. IANA Considerations 📋

IANA registered a new name-type OID in "SMI Security for Name System Designators Codes (nametypes)" 🎉

   6  gss-composite-export [RFC6680]

(The absolute OID is 1.3.6.1.5.6.6.)

This document creates a namespace of GSS-API name attributes 🌈 Attributes are named by URIs, so technically no single authority is needed to allocate them. Future deployment experience might show a need for an IANA registry of URIs used to reference names specified by IETF standards. It's expected that this will be a registry of URNs, but this document doesn't give any more guidance on that registry 📝

9. Security Considerations 🚨🔐

This document extends the GSS-API naming model to support name attributes 💅 The idea is that name attributes get used as a basis for (among other things) authorization decisions or personalization for apps relying on GSS-API security contexts 🎀

Okay, bestie, this part is SERIOUS. The security of the app may depend heavily on the security of its attributes 😭 This document sorts attributes into asserted or authenticated. Asserted (non-authenticated) attributes MUST NOT be used if the attribute has security implications for the app (like authorization decisions), because the peer can totally control asserted attributes directly 💀

It's super important to get what "authenticated" means here 🧠 Authenticated does NOT mean any semantic of the attribute is claimed to be true. The only thing it tells you is that a trusted third party asserted the attribute instead of the peer asserting it itself. Any extra meaning comes from applying policy 📜 For example, in one deployment the mail attribute of the subject might be authenticated and pulled from an email system where the "authoritative" values live. In another situation, users might be free to change their mail addresses whenever they want. In both cases, the "mail" attribute could count as authenticated because it's in signed SAML attribute assertions or because the underlying mechanism authenticated it some other way 🫶

When the underlying security mechanism doesn't give a permanent unique identity (like anonymous Kerberos), GSS-API naming extensions can be used to add a permanent unique identity attribute 🪪 That identifier might be globally unique, unique within the issuer's attribute namespace, or a "directed" identifier that's unique per peer acceptor identity. SAML, as one example, has a bunch of built-in constructs for this, like a <NameID> with a Format of urn:oasis:names:tc:SAML:2.0:nameid-format:persistent. SAML deployments also tend to use domain-specific attribute types that can serve as identifiers 🌸

10. References 📚

10.1. Normative References 💅

okay so these are the docs this spec literally can't function without, bestie 📚✨ the full entries are below, exactly as written

[GFD.024]  Meder, S., Welch, V., Tuecke, S., and D. Engert, "GSS-API
           Extensions", Global Grid Forum GFD.024, June 2004,
           <http://www.ggf.org/documents/GFD.24.pdf>.

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2743]  Linn, J., "Generic Security Service Application Program
           Interface Version 2, Update 1", RFC 2743, January 2000.

[RFC2744]  Wray, J., "Generic Security Service API Version 2 :
           C-bindings", RFC 2744, January 2000.

[RFC5587]  Williams, N., "Extended Generic Security Service Mechanism
           Inquiry APIs", RFC 5587, July 2009.

10.2. Informative References 🦋

these ones are more like bonus reading, lowkey super useful for context but the spec doesn't need you to have read them to work 🌸 full entries below, verbatim

[ANSI.X3-4.1986]
           American National Standards Institute, "Coded Character
           Set - 7-bit American Standard Code for Information
           Interchange", ANSI X3.4, 1986.

[OASIS.saml-core-2.0-os]
           Cantor, S., Kemp, J., Philpott, R., and E. Maler,
           "Assertions and Protocol for the OASIS Security Assertion
           Markup Language (SAML) V2.0", OASIS Standard saml-core-
           2.0-os, March 2005.

[RFC3629]  Yergeau, F., "UTF-8, a transformation format of ISO
           10646", STD 63, RFC 3629, November 2003.

[RFC4120]  Neuman, C., Yu, T., Hartman, S., and K. Raeburn, "The
           Kerberos Network Authentication Service (V5)", RFC 4120,
           July 2005.

[RFC4556]  Zhu, L. and B. Tung, "Public Key Cryptography for Initial
           Authentication in Kerberos (PKINIT)", RFC 4556, June 2006.

[RFC4768]  Hartman, S., "Desired Enhancements to Generic Security
           Services Application Program Interface (GSS-API) Version 3
           Naming", RFC 4768, December 2006.

Authors' Addresses 🌈

meet the squad who wrote this thing 🫶 their contact details are right here

Nicolas Williams
Cryptonector, LLC

EMail: nico@cryptonector.com


Leif Johansson
Swedish University Network
Thulegatan 11
Stockholm
Sweden

EMail: leifj@sunet.se
URI:   http://www.sunet.se


Sam Hartman
Painless Security

EMail: hartmans-ietf@mit.edu


Simon Josefsson
SJD AB
Johan Olof Wallins Vaeg 13
171 64 Solna
Sweden

EMail: simon@josefsson.org
URI:   http://josefsson.org/

that's the whole RFC, periodt 💖✨ these four were literally the main characters of GSS-API naming, iconic 👑

📦 where this page comes from

ietf: rfc6680 2012-08
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms