1. Mark A. Shaw CS 522 Project Presentation
Wireless Application Protocol and the Wireless Transport Layer Security
Mark A. Shaw
CS 522 Project Presentation

2. Mark A. Shaw mashaw@mail.uccs.edu
Introduction
WAP
SonyEricsson develop Intelligent Terminal Transfer Protocol (ITTP) for Value Added Services (VAS)
Unwired Planet (n.k.a Phone.com) develop Handheld Device Markup Language (HDML) and Handheld Device Transfer Protocol (HDTP)
Nokia develop Smart Messaging, Timetabling Markup Language (TTML) – 1997
WAP Forum formed in June 1997
WTLS
Security Layer for WAP
Based on Transport Layer Security v.1.0 (SSL)
Optimized Handshaking
Long Lasting Secure Sessions
9/20/2018
Mark A. Shaw

3. Mark A. Shaw mashaw@mail.uccs.edu
WAP Architecture
9/20/2018
Mark A. Shaw

4. Mark A. Shaw mashaw@mail.uccs.edu
WAP Development
WAP is designed to work on any of the existing wireless services, using standards such as:
Short Message Service (SMS)
High-Speed Circuit-Switched Data (CSD)
General Packet Radio Service (GPRS)
Unstructured Supplementary Services Data (USSD)
9/20/2018
Mark A. Shaw

5. Mark A. Shaw mashaw@mail.uccs.edu
WAP Limitations
Limited CPU,
Memory
Limited Bandwidth
I’m
Popular!
Limited Display
Limited Keyboard
9/20/2018
Mark A. Shaw

6. Application Layer (WAE) Transaction Layer (WTP)
WAP Protocol Stack
Application Layer (WAE)
Other Services
&
Applications
Session Layer (WSP)
Transaction Layer (WTP)
Security Layer (WTLS)
Transport Layer (WDP)
Bearers:
GSM
CDMA
CDPD
IS-136
iDEN
9/20/2018
Mark A. Shaw

7. WAP Protocol Stack (‘Cont’)
Makes applications independent of bearers and other hardware
External applications and services may access the layers directly
Modified to allow for
Lower Bandwidth (9.6kbps – 14.4kbps)
Network latency (6 – 10 seconds on SMS)
Unreliable connections
9/20/2018
Mark A. Shaw

8. Wireless Transport Layer Security (WTLS)
WTLS is an optional layer
Privacy thru encryption
Authentication & nonrepudiation thru digital certificates
Compression
Elliptic Curve Cryptography (ECC)
9/20/2018
Mark A. Shaw

9. Mark A. Shaw mashaw@mail.uccs.edu
WTLS ‘Cont’
WTLS is a variant of TLS optimized for
use in wireless applications
Authentication: Asymmetric Key Crypto
Class 1: No Authentication
Class 2: Server Authentication
Class 3: Mutual Authentication
Privacy: Symmetric Key Crypto
Data Integrity: MACs
9/20/2018
Mark A. Shaw

10. WTLS Class 1 Authentication
ClientHello >
ServerHello
< ServerHelloDone
ClientKeyExchange
ChangeCipherSpec
Finished >
< Finished
Application Data < > Application Data
9/20/2018
Mark A. Shaw

11. WTLS Class 2 Authentication
Server Authentication Only
ClientHello >
ServerHello
Certificate
< ServerHelloDone
ClientKeyExchange
ChangeCipherSpec
Finished >
< Finished
Application Data < > Application Data
9/20/2018
Mark A. Shaw

12. WTLS Class 3 Authentication
Mutual Authentication
Client Hello > ServerHello
Certificate
CertificateRequest
< ServerHelloDone
ClientKeyExchange (only for RSA)
CertificateVerify
ChangeCipherSpec
Finished >
< Finished
Application Data < > Application Data
9/20/2018
Mark A. Shaw

13. Mark A. Shaw mashaw@mail.uccs.edu
WTLS Security Issues
WTLS allows for weak encryption algorithms
Plain-text data recovery attack
Datagram truncation attack
Message forgery attack
Exportable key-search shortcut
9/20/2018
Mark A. Shaw

14. Mark A. Shaw mashaw@mail.uccs.edu
WAP Future?
Diminishing Popularity
Replaced in favor of
Outdated Specifications
9/20/2018
Mark A. Shaw

15. Mark A. Shaw mashaw@mail.uccs.edu
Resources
Nokia WAP Developer Forum
WAP-210, Wireless Application Protocol Architecture Specification
WAP-191, Wireless Markup Language Specification
WAP-193, WMLScript Language Specification
WAP-261, Wireless Transport Layer Security Specification
WAP-161, WMLScript Crypto API Library
WAP-187, WAP Transport Layer E2E Security Specification
WAP-217, WAP Public Key Infrastructure Definition
Computer Networks, Andrew S. Tanenbaum, 4th Edition
Network Security with OpenSSL, Viega, Messier & Chandra
Secure Network Programming Cookbook for C and C++, Viega, Messier, & Spafford
9/20/2018
Mark A. Shaw

16. Mark A. Shaw mashaw@mail.uccs.edu
The End
Questions?
9/20/2018
Mark A. Shaw