# Security Mechanisms Provide a security mechanism for your implementation. ## Overview For more information on the attributes of a mechanism, see [RFC 5587](https://tools.ietf.org/html/rfc5587). ## Topics ### Standard Mechanisms The underlying security mechanisms that GSS-API may use to provide secure communications. [`GSS_KRB5_MECHANISM`](/documentation/GSS/GSS_KRB5_MECHANISM) The Kerberos Version 5 Mechanism (KRB5). [`GSS_NTLM_MECHANISM`](/documentation/GSS/GSS_NTLM_MECHANISM) The Microsoft NT LAN Manager Mechanism (NTLM). [`GSS_IAKERB_MECHANISM`](/documentation/GSS/GSS_IAKERB_MECHANISM) The Initial and Pass Through Authentication Using Kerberos V5 and the GSS-API Mechanism (IAKERB). [`GSS_PKU2U_MECHANISM`](/documentation/GSS/GSS_PKU2U_MECHANISM) The Public Key Cryptography Based User-to-User Mechanism (PKU2U). [`GSS_SPNEGO_MECHANISM`](/documentation/GSS/GSS_SPNEGO_MECHANISM) The Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO). [`GSS_SCRAM_MECHANISM`](/documentation/GSS/GSS_SCRAM_MECHANISM) The Salted Challenge Response Authentication Mechanism (SCRAM). ### Heimdal Mechanisms [`GSS_SASL_DIGEST_MD5_MECHANISM`](/documentation/GSS/GSS_SASL_DIGEST_MD5_MECHANISM) The Simple Authentication and Security Layer (SASL) Mechanism with Digest-MD5. [`GSS_NETLOGON_MECHANISM`](/documentation/GSS/GSS_NETLOGON_MECHANISM) The Microsoft Net Logon Mechanism. [`GSS_APPL_LKDC_SUPPORTED`](/documentation/GSS/GSS_APPL_LKDC_SUPPORTED) Local KDC is supported. ### Netlogon Set [`GSS_NETLOGON_SET_SESSION_KEY_X`](/documentation/GSS/GSS_NETLOGON_SET_SESSION_KEY_X) The Netlogon set session key value. [`GSS_NETLOGON_SET_SIGN_ALGORITHM_X`](/documentation/GSS/GSS_NETLOGON_SET_SIGN_ALGORITHM_X) The Netlogon algorithm key value. [`GSS_NETLOGON_NT_NETBIOS_DNS_NAME`](/documentation/GSS/GSS_NETLOGON_NT_NETBIOS_DNS_NAME) The Netlogon NetBIOS DNS name value. ### Mechanisms and Authentication [`GSS_C_MA_MECH_CONCRETE`](/documentation/GSS/GSS_C_MA_MECH_CONCRETE) A mechanism that is neither a psuedo-mechanism nor a composite mechanism. [`GSS_C_MA_MECH_PSEUDO`](/documentation/GSS/GSS_C_MA_MECH_PSEUDO) A pseudo-mechanism. [`GSS_C_MA_MECH_COMPOSITE`](/documentation/GSS/GSS_C_MA_MECH_COMPOSITE) A mechanism that is a composite of other mechanisms. [`GSS_C_MA_MECH_NEGO`](/documentation/GSS/GSS_C_MA_MECH_NEGO) A mechanism that negotiates other mechanisms. [`GSS_C_MA_MECH_GLUE`](/documentation/GSS/GSS_C_MA_MECH_GLUE) An OID that is for the GSS-API rather than for a mechanism. [`GSS_C_MA_NOT_MECH`](/documentation/GSS/GSS_C_MA_NOT_MECH) A known OID that is neither a GSS-API mechanism nor an identifier of the GSS-API itself. [`GSS_C_MA_DEPRECATED`](/documentation/GSS/GSS_C_MA_DEPRECATED) A mechanism that is no longer used. [`GSS_C_MA_NOT_DFLT_MECH`](/documentation/GSS/GSS_C_MA_NOT_DFLT_MECH) A mechanism that is not suitable for use as a default mechanism. [`GSS_C_MA_ITOK_FRAMED`](/documentation/GSS/GSS_C_MA_ITOK_FRAMED) The given mechanism’s initial context tokens are properly framed. [`GSS_C_MA_AUTH_INIT`](/documentation/GSS/GSS_C_MA_AUTH_INIT) Support for authentication of initiator to acceptor. [`GSS_C_MA_AUTH_TARG`](/documentation/GSS/GSS_C_MA_AUTH_TARG) Support for authentication of acceptor to initiator. [`GSS_C_MA_AUTH_INIT_INIT`](/documentation/GSS/GSS_C_MA_AUTH_INIT_INIT) Support for initial authentication of initiator to acceptor. [`GSS_C_MA_AUTH_TARG_INIT`](/documentation/GSS/GSS_C_MA_AUTH_TARG_INIT) Support for initial authentication of acceptor to initiator. [`GSS_C_MA_AUTH_INIT_ANON`](/documentation/GSS/GSS_C_MA_AUTH_INIT_ANON) Anonymous support as a target principal name. [`GSS_C_MA_AUTH_TARG_ANON`](/documentation/GSS/GSS_C_MA_AUTH_TARG_ANON) Anonymous support as a target principal name. [`GSS_C_MA_DELEG_CRED`](/documentation/GSS/GSS_C_MA_DELEG_CRED) Support for credential delegation. [`GSS_C_MA_INTEG_PROT`](/documentation/GSS/GSS_C_MA_INTEG_PROT) Support for per-message integrity protection. [`GSS_C_MA_CONF_PROT`](/documentation/GSS/GSS_C_MA_CONF_PROT) Support for per-message confidentiality protection. [`GSS_C_MA_MIC`](/documentation/GSS/GSS_C_MA_MIC) Support for Message Integrity Code (MIC) tokens. [`GSS_C_MA_WRAP`](/documentation/GSS/GSS_C_MA_WRAP) Support for WRAP tokens. [`GSS_C_MA_PROT_READY`](/documentation/GSS/GSS_C_MA_PROT_READY) Support for per-message protection prior to full context establishment. [`GSS_C_MA_REPLAY_DET`](/documentation/GSS/GSS_C_MA_REPLAY_DET) Support for replay detection. [`GSS_C_MA_OOS_DET`](/documentation/GSS/GSS_C_MA_OOS_DET) Support for out-of-sequence detection. [`GSS_C_MA_CBINDINGS`](/documentation/GSS/GSS_C_MA_CBINDINGS) Support for channel bindings. [`GSS_C_MA_PFS`](/documentation/GSS/GSS_C_MA_PFS) Support for perfect forward security. [`GSS_C_MA_COMPRESS`](/documentation/GSS/GSS_C_MA_COMPRESS) Support for compression of data inputs to the wrap function. [`GSS_C_MA_CTX_TRANS`](/documentation/GSS/GSS_C_MA_CTX_TRANS) Support for security context importing and exporting. [`GSS_C_MA_SASL_MECH_NAME`](/documentation/GSS/GSS_C_MA_SASL_MECH_NAME) The name of the SASL mechanism. [`GSS_C_MA_MECH_NAME`](/documentation/GSS/GSS_C_MA_MECH_NAME) The name of the GSS-API mechanism. [`GSS_C_MA_MECH_DESCRIPTION`](/documentation/GSS/GSS_C_MA_MECH_DESCRIPTION) The long description of the mechanism. ### Queries [`gss_indicate_mechs`](/documentation/GSS/gss_indicate_mechs(_:_:)) Returns the list of supported underlying security mechanisms. [`gss_indicate_mechs_by_attrs`](/documentation/GSS/gss_indicate_mechs_by_attrs(_:_:_:_:_:)) Returns the set of mechanisms that fulfill the given criteria. [`gss_display_mech_attr`](/documentation/GSS/gss_display_mech_attr(_:_:_:_:_:)) Returns a human-readable name and description of a mechanism attribute. [`gss_inquire_attrs_for_mech`](/documentation/GSS/gss_inquire_attrs_for_mech(_:_:_:_:)) Returns the supported attributes for one or all mechanisms. [`gss_inquire_mech_for_saslname`](/documentation/GSS/gss_inquire_mech_for_saslname(_:_:_:)) Returns the GSS-API mechanism identifier for a given Simple Authentication and Security Layer (SASL) protocol name. [`gss_inquire_saslname_for_mech`](/documentation/GSS/gss_inquire_saslname_for_mech(_:_:_:_:_:)) Returns the Simple Authentication and Security Layer (SASL) protocol name for a given GSS-API mechanism. --- Copyright © 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)