In "The Kerberos 5 GSS-API Mechanism " doc, the following corrections should be made:

The first sentence of the Note should say:

"The AES-128 and AES-256 encryption types are enabled by default."

In the last list (default values for krb5.conf file parameters), the permitted_enctypes field is incorrect. It only contains the etypes that are enabled by default (the aes128 and aes256 etypes). This change was made in JDK 18 in https://bugs.openjdk.java.net/browse/JDK-8273670.