Wireless Transport Layer Security

Wireless Transport Layer Security

Wireless Transport Layer Security (WTLS) is a security protocol, part of the Wireless Application Protocol (WAP) stack. It sits between the WTP and WDP layers in the WAP communications stack.

Overview

WTLS is derived from TLS. WTLS uses similar semantics adapted for a low bandwidth mobile device. The main changes are…

* Compressed data structures — Where possible packet sizes are reduced by using bit-fields, discarding redundancy and truncating some cryptographic elements.
* New certificate format — WTLS defines a compressed certificate format. This broadly follows the X.509 v3 certificate structure, but uses smaller data structures.
* Packet based design — TLS is designed for use over a data stream. WTLS adapts that design to be more appropriate on a packet based network. A significant amount of the design is based on a requirement that it be possible to use a packet network such as SMS as a data transport.

WTLS has been superseded in the WAP 2.0 standard by the End-to-end Transport Layer Security Specification.

ecurity

WTLS uses modern cryptographic algorithms and in common with TLS allows negotiation of cryptographic suites between client and server.

Algorithms

An incomplete list…
* Key Exchange and Signature
** RSA
** Elliptic Curve Cryptography (ECC)
* Symmetric Encryption
** DES
** Triple DES
** RC5
* Message Digest
** MD5
** SHA1

ecurity criticisms

* Encryption/Decryption at the gateway — in the WAP architecture the content is typically stored on the server as uncompressed WML (an XML DTD). That content is retrieved by the gateway using HTTP and compressed into WBXML, in order to perform that compression the gateway must be able to handle the WML in cleartext, so even if there is encryption between the client and the gateway (using WTLS) and between the gateway and the originating server (using HTTPS) the gateway acts as a man-in-the-middle. This gateway architecture serves a number of purposes: transcoding between HTML and WML; content providers need not implement WBXML compression; removes reliance on DNS; enables a walled garden
* Digest truncation — HMAC message digests are truncated to reduce transmission overhead, this reduces the theoretical effectiveness of the HMAC potentially reducing the data integrity protection.
* Inadequate review — WTLS is significantly different from TLS, it is not clear that the changes made to WTLS have not in some way weakened the security. The use of a new certificate format is an example of this. The format defined in the WTLS specification may not be appropriate for all the uses to which a certificate may be used.
* Client Implementation - As there are no official specifications which WTLS implementations must adhere to, many may use insecure cryptographic algorithms or key generation processes. In some client software, WTLS may even be disabled.

Interoperability

As mentioned above the client and server negotiate the cryptographic suite. This happens when the session is started, briefly the client sends a list of supported algorithms and the server chooses a suite, or refuses the connection. The standard does not mandate support of any algorithm. An endpoint (either client or server) that needs to be interoperable with any other endpoint may need to implement every algorithm (including some covered by intellectual property rights).

External links

* [http://www.wapforum.org WAP forum]


Wikimedia Foundation. 2010.

Игры ⚽ Поможем сделать НИР

Look at other dictionaries:

  • Wireless Transport Layer Security — (WTLS) ist ein Verschlüsselungsprotokoll für die Übertragung von Daten mittels mobiler Geräte. Es basiert auf dem TLS Protokoll und wurde für den Einsatz auf mobilen Geräten bzw. in Funknetzwerken optimiert. Die vergleichsweise geringe… …   Deutsch Wikipedia

  • Wireless Transport Layer Security — o WTLS (seguridad para la capa de transporte en comunicaciones inalámbricas) es un protocolo de seguridad, perteneciente al conjunto de protocolos de Wireless Application Protocol (WAP). Contenido 1 Visión General 2 Seguridad 2.1 Algoritmos …   Wikipedia Español

  • Wireless Transport Layer Security — (WTLS) est un composant du protocole WAP. Il se situe entre les couches WTP et WDP de la pile de communication de WAP. Sommaire 1 Généralités 2 Sécurité 2.1 Algorithmes …   Wikipédia en Français

  • Transport Layer Security — Pile de protocoles 7.  Application 6.  Présentation 5.  Session 4.  Tr …   Wikipédia en Français

  • Wireless Application Protocol — o WAP (protocolo de aplicaciones inalámbricas) es un estándar abierto internacional para aplicaciones que utilizan las comunicaciones inalámbricas, p.ej. acceso a servicios de Internet desde un teléfono móvil. Se trata de la especificación de un… …   Wikipedia Español

  • Wireless Application Protocol — Not to be confused with Wireless access point. Wireless Application Protocol (WAP) is a technical standard for accessing information over a mobile wireless network. A WAP browser is a web browser for mobile devices such as mobile phones (called… …   Wikipedia

  • Wireless Transaction Protocol — Das Wireless Application Protocol (WAP) bezeichnet eine Sammlung von Techniken und Protokollen, deren Zielsetzung es ist, Internetinhalte für die langsamere Übertragungsrate und die längeren Antwortzeiten im Mobilfunk sowie für die kleinen… …   Deutsch Wikipedia

  • Wireless Application Protocol — Protocole WAP Wikipedia sur un téléphone mobile WAP Le protocole WAP (en anglais : Wireless Application Protocol ou WAP)[1] est un protocole de communication qui permet d accéder …   Wikipédia en Français

  • Wireless application protocol — Protocole WAP Wikipedia sur un téléphone mobile WAP Le protocole WAP (en anglais : Wireless Application Protocol ou WAP)[1] est un protocole de communication qui permet d accéder …   Wikipédia en Français

  • Wireless security — An example wireless router, that can implement wireless security features Wireless security is the prevention of unauthorized access or damage to computers using wireless networks. Many laptop computers have wireless cards pre installed. The… …   Wikipedia

Share the article and excerpts

Direct link
Do a right-click on the link above
and select “Copy Link”