Wireless Transport Layer Security Article Index for
Wireless 		Website Links For
Wireless 		 

Information About

Wireless Transport Layer Security
  CATEGORIES ABOUT WIRELESS TRANSPORT LAYER SECURITY
   
cryptographic protocols
   
internet standards
   
mobile
   
transport layer protocols
   
APPAREL
BABY
BEAUTY
BOOKS
CAR TOYS
CELL PHONES
DVD'S
ELECTRONICS
GOURMET FOOD
GROCERIES
HEALTH & PERSONAL
HOME & GARDEN
JEWELRY
MUSIC
MUSIC INSTRUMENTS
OFFICE PRODUCTS
SOFTWARE
SPORTING GOODS
TOOLS & HARDWARE
TOYS
VIDEO GAMES
SHOPPING HOME
MORE SHOPPING...




OVERVIEW


WTLS is derived from TLS . WTLS uses similar semantics adapted for a low bandwidth mobile device. The main changes are…

  • Compressed data structures — Where possible packet sizes are reduced by using bit-fields, discarding redundancy and truncating some cryptographic elements.

  • New certificate format — WTLS defines a compressed certificate format. This broadly follows the X.509 V3 certificate structure, but uses smaller data structures.

  • Packet based design — TLS is designed for use over a data stream. WTLS adapts that design to be more appropriate on a packet based network. A significant amount of the design is based on a requirement that it be possible to use a packet network such as SMS as a data transport.


WTLS has been superseded in the WAP 2.0 standard by the End-to-end Transport Layer Security Specification.


SECURITY

WTLS uses modern Cryptographic algorithms and in common with TLS allows negotiation of cryptographic suites between client and server.


Algorithms

An incomplete list…


Security criticisms

  • Encryption/Decryption at the gateway — in the WAP architecture the content is typically stored on the server as uncompressed

  • Digest truncation — HMAC message digests are truncated to reduce transmission overhead, this reduces the theoretical effectiveness of the HMAC potentially reducing the Data Integrity protection.

  • Inadequate review — WTLS is significantly different from TLS, it is not clear that the changes made to WTLS have not in some way weakened the security. The use of a new certificate format is an example of this. The format defined in the WTLS specification may not be appropriate for all the uses to which a certificate may be used.



INTEROPERABILITY

As mentioned above the client and server negotiate the cryptographic suite. This happens when the session is started, briefly the client sends a list of supported algorithms and the server chooses a suite, or refuses the connection. The standard does not mandate support of any algorithm. An endpoint (either client or server) that needs to be interoperable with any other endpoint may need to implement every algorithm (including some covered by intellectual property rights).


EXTERNAL LINKS