The transport of data between the client and the RP is not provided by GSS-API. GSS-API creates and consumes messages, but it does not provide the transport itself; instead, the protocol using GSS-API needs to provide the transport. In many cases, HTTP or HTTPS is used for this transport, but other transports are perfectly acceptable. The core GSS-API document [RFC2743] provides some details on what requirements exist.