📑 Table of Contents▼

Simple Authentication and Security Layer (SASL) is a framework for authentication and data security in Internet protocols. It decouples authentication mechanisms from application protocols, in theory allowing any authentication mechanism supported by SASL to be used in any application protocol that uses SASL. Authentication mechanisms can also support proxy authorization, a facility allowing one user to assume the identity of another. They can also provide a data security layer offering data integrity and data confidentiality services. DIGEST-MD5 provides an example of mechanisms which can provide a data-security layer. Application protocols that support SASL typically also support Transport Layer Security (TLS) to complement the services offered by SASL.

John Gardiner Myers wrote the original SASL specification (RFC 2222) in 1997. In 2006, that document was replaced by RFC 4422 authored by Alexey Melnikov and Kurt D. Zeilenga. SASL, as defined by RFC 4422 is an IETF Standard Track protocol and is, as of 2006, a Proposed Standard.

SASL mechanisms

edit

A SASL mechanism implements a series of challenges and responses. Defined SASL mechanisms[1] include:

EXTERNAL
where authentication is implicit in the context (e.g., for protocols already using IPsec or TLS)
ANONYMOUS
for unauthenticated guest access
PLAIN
a simple cleartext password mechanism, defined in RFC 4616
OTP
a one-time password mechanism. Obsoletes the SKEY mechanism.
SKEY
an S/KEY mechanism.
CRAM-MD5
a simple challenge-response scheme based on HMAC-MD5.
DIGEST-MD5
(historic[2]), partially HTTP Digest compatible challenge-response scheme based upon MD5. DIGEST-MD5 offered a data security layer.
SCRAM
(RFC 5802), modern challenge-response scheme based mechanism with channel binding support
NTLM
an NT LAN Manager authentication mechanism
GS2-
family of mechanisms supports arbitrary GSS-API mechanisms in SASL.[3] It is now standardized as RFC 5801.
GSSAPI
for Kerberos V5 authentication via the GSSAPI. GSSAPI offers a data-security layer.
BROWSERID-AES128
for Mozilla Persona authentication[4]
EAP-AES128
for GSS EAP authentication[5]
MSN Chat GateKeeper (& GateKeeperPassport)
a challenge-response mechanism developed by Microsoft for MSN Chat
OAUTHBEARER
OAuth 2.0 bearer tokens (RFC 6750), communicated through TLS[6]
OAUTH10A
OAuth 1.0a message-authentication-code tokens (RFC 5849, Section 3.4.2)[6]

SASL-aware application protocols

edit

Application protocols define their representation of SASL exchanges with a profile. A protocol has a service name such as "ldap" in a registry shared with GSSAPI and Kerberos.[7]

As of 2012 protocols currently supporting SASL include:

See also

edit

References

edit
  1. ^ "Simple Authentication and Security Layer (SASL) Mechanisms". iana.org.
  2. ^ RFC 6331
  3. ^ Simon Josefsson. "Using GSS-API Mechanisms in SASL: The GS2 Mechanism Family".
  4. ^ Luke Howard. "A SASL and GSS-API Mechanism for the BrowserID Authentication Protocol".
  5. ^ Sam Hartman (December 2013). "A GSS-API Mechanism for the Extensible Authentication Protocol".
  6. ^ a b A Set of Simple Authentication and Security Layer (SASL) Mechanisms for OAuth. IETF. August 2015. doi:10.17487/RFC7628. RFC 7628. Retrieved October 7, 2016.
  7. ^ "Generic Security Service Application Program Interface (GSSAPI)/Kerberos/Simple Authentication and Security Layer (SASL) Service Names". iana.org.
  8. ^ "Request for allocation of new security type code for SASL auth". realvnc.com.
edit
  • RFC 4422 - Simple Authentication and Security Layer (SASL) - obsoletes RFC 2222
  • RFC 4505 - Anonymous Simple Authentication and Security Layer (SASL) Mechanism - obsoletes RFC 2245
  • RFC 4616 - The PLAIN Simple Authentication and Security Layer (SASL) Mechanism - updates RFC 2595
  • The IETF SASL Working Group, chartered to revise existing SASL specifications, as well as to develop a family of GSSAPI mechanisms
  • Cyrus SASL, a free and portable SASL library providing generic security for various applications
  • GNU SASL, a free and portable SASL command-line utility and library, distributed under the GNU GPLv3 and LGPLv2.1, respectively
  • Dovecot SASL, an SASL implementation
  • RFC 2831 (historic) - Using Digest Authentication as a SASL Mechanism, obsoleted in RFC 6331
  • Java SASL API Programming and Deployment Guide

📚 Artikel Terkait di Wikipedia

WinSCP

Since July 16, 2003, the program and its source code is licensed under the GNU GPL. It is hosted on SourceForge and GitHub. WinSCP is based on the implementation

Cassowary (software)

Dart, Squeak, Python, the .NET Framework, and Rust. As of September 2014, GSS, a layout language and layout engine for the web, is being developed by The

Salted Challenge Response Authentication Mechanism

(2011-02-06). "GNU Network Security Labyrinth" (PDF). Retrieved 2023-08-04. "Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms:

Technology CAD

doi:10.1109/43.898831. "GSS: Two-dimensional semiconductor simulator". gss-tcad.sourceforge.net. "GNU Archimedes". "Archimedes". www.gnu.org. "DEVSIM TCAD Semiconductor

Secure Shell

2006) RFC 4462 – Generic Security Service Application Program Interface (GSS-API) Authentication and Key Exchange for the Secure Shell (SSH) Protocol

Balsa (email client)

gmime. It also can optionally use libgtkhtml for HTML rendering, libkrb5 for GSS-API, and openldap for LDAP functionality. It can optionally be configured

Rsyslog

path a given message has traversed reliable transport using TCP support GSS-API and TLS logging directly into various database engines. support for RFC

List of acronyms: G

(i) Good Sense Of Humour GSP – Georges St-Pierre (Canadian MMA fighter) GSS – (i) Generic Security Services GST – (i) Goods and Services Tax (Australia