Security in WAP and WTSL By Yun Zhou

Overview of WAP (Wireless Application Protocol)  Proposed by the WAP Forum (Phone.com, Ericsson, Nokia, Motorola) in  A wireless communication model, similar to the ISO OSI model  An application environment for deploying wireless services regardless of different types of services, wireless bearers, and devices.  WAP provides a series of security measures  However, there are still various security loopholes in WAP.

WAP Architecture Components: WAP device (cell phone), WAP client/browser, User agent, Network operator (companies that provides bearer services), Bearer services (SMS, CDMA…), Application server

WAP Protocols Recall the ISO OSI model: WAE (Wireless Application Environment): WML, WMLScript WSP (Wireless Session Protocol) and WTP (Wireless Transaction Protocol): together provide session layer services connection oriented sessions or connectionless sessions. Reliable sessions can be resumed. WTLS (Wireless Transport Layer Security) (Optional)

Overview of WTLS  Based on TLS  Provides client-server mutual authentication, privacy, data integrity, non-repudiation  But not the same as TLS  Modifications due to  Narrow-bandwidth communication channel  Much less processing power  Much less memory  High loss ratio  Unexpected disconnections  Restrictions on exported encryption algorithms  Built on top of WDP and UDP (unreliable data transfer)  More security problems

WTLS Sub-Protocols  WTLS contains four sub-protocols:  Handshake protocol: Client and server negotiate over the security parameters to be used for later message exchanges  Alert protocol: Specifies the types of alerts and how to handle them. warning, critical, fatal Alerts can be sent by either the client or the server.  Application protocol: interface for the upper layer  Change Cipher Spec Protocol: Usually used towards the end of the handshake when the negotiation succeeds

What does the handshake specify?

Handshake Procedure Complete handshake Resume connection

How Security Functions Are Achieved  Authentication: Supports X.509v3 and X9.68 certificates, optimized sizes.  Key exchange: RSA, DH, ECC-DH (Preferable algorithm for WAP)  Bulk encryption algorithms: RC5 with 40, 56 or 128 bit keys, DES with 40 or 56 bit keys, 3DES, IDEA with 40, 56 or 128 bit keys, and ECC. (No stream ciphers) master_secret = PRF(pre_master_secret, "master secret", ClientHello.random + ServerHello.random) key_block = PRF(master_secret + expansion_label + seq_num + server_random + client_random); Keys and IVs are all generated from key_blocks. Keys are refreshed according to the negotiated frequency.  MAC algorithms: SHA-1, MD5, and SHA_XOR_40

Security Loopholes, Threats, Solutions - WAP Gateway  Decrypts and re-encrypts data – “White spot”  End-to-end security, but the ends are actually the web client and the gateway.  Solution by the network operators: Decrypts and re-encrypts only in the memory  Cannot solve the problem entirely: still uses swapfiles, hackers can do core dumps  Some companies try to completely get rid of the WAP gateway.

Deploy the Gateway in the Server’s network Decryption and re-encryption are done on the server side.

Security Loopholes, Threats, Solutions - WTLS  Has to use keys of small sizes: 40-bit DES -> 35 bits are actually used  Allows weak algorithms to be chosen  exchanges unauthorized messages or unencrypted packet fields, such as alert messages and recode_type field.  Vulnerable to viruses, Trojan horses, and worms.  Saarinen discussed a chosen plaintext data recovery attack, a datagram truncation attack, a message forgery attack, and a key-search shortcut for some exportable keys

Attack against SHA_XOR_40  SHA_XOR_40: Padded messages are divided into 5-byte blocks. All blocks are XOR’ed to get the digest.  Attack: Flip a bit in one block, flip the bit in the corresponding position in the digest  Tada! Message modification succeeds!

User Authentication vs. Device Authentication - WIM  Mobile devices are easy to lose  One British article reported that “for the first time of this century the umbrella has been overtaken as the most popular item to leave on a train — by mobile phones”.  Cannot authenticate user if the passwords and certificates are stored locally  Use WIM (Wireless Identity Module), which can be a smart card or a SIM card.  Dedicated memory  Provides user authentication  Need to keep it separately from the device. Hard to achieve.

References Arehart, C., Professional WAP, Wrox Press Ltd, Jormalainen, S., Laine, J. “Security in WTLS”, 10/1/2000. Referred on 3/24/2004], Nicolas, R., Lekkas, P. Wireless security : models, threats, and solutions. McGraw-Hill Saarinen, Markku-Juhani, “Attacks against the WAP WTLS Protocol”, 9/ [Referred on 3/24/2004], Schneier, B., Applied Cryptography, Second Edition, John Wiley & Sons, Inc, p. 758, WAP Forum, “WAP Security Group (WSG) Charter”, 6/12/2002 [Referred on 3/24/2004].