WTLS

~ the eulogy ~

Every layer of the WAP stack was a smaller copy of something from the wired internet, and WTLS was the copy of TLS. It sat between WTP and WDP in the stack and did what TLS did, negotiating a cipher suite and setting up an encrypted session, except sized for a handset with a few hundred kilobytes of memory on a link measured in single-digit kilobits. The engineering was careful. Data structures were packed into bit fields and redundancy was stripped out, and the certificate format was redrawn to follow X.509 v3 at a fraction of the size. Because the bearer might be SMS rather than a stream, the whole thing was redesigned around packets.

It also had a hole in it that was not a bug, and everyone who studied the architecture found the same one. A WAP page lived on the origin server as plain WML. The gateway fetched it over HTTP and compressed it into WBXML, the binary form the handset could actually parse, and to do that compression the gateway had to hold the page as readable text. So you could have WTLS between the phone and the gateway and HTTPS between the gateway and the bank, and there would still be one machine in the middle of that session where your statement existed in the clear. The industry called it the WAP gap.

I was in Turkey for all of this, and what I remember is the padlock, which appeared on a phone screen the same way it appeared in a browser and meant something quite different. In a browser it meant end to end. On a handset it meant encrypted as far as whichever operator's gateway the request was routed through, and the operator was not a neutral pipe, it was the company selling you the portal you were looking at. The distinction went unexplained because explaining it meant saying out loud where mobile banking actually stopped being private.

~ the dossier ~

~ what they cut to make it fit ~

The cipher list tells you how tight the budget was. Key exchange and signature could be RSA or elliptic curve, the symmetric options included DES and RC5, and the message digests were MD5 and SHA-1. Those were defensible choices for 1999 hardware and several of them were already looking thin by the time the final specification was published.

Two of the economies caused real argument. HMAC digests were truncated to save bytes on the wire, which reduces the theoretical strength of the integrity check for a saving measured in single digits. And the standard mandated no algorithm at all, which sounds liberal and in practice meant that an endpoint wanting to interoperate with anything had to implement everything, including suites covered by patents. Markku-Juhani Saarinen published an analysis of attacks on the protocol in 1999, and the broader criticism was harder to answer than any single attack: WTLS differed from TLS in enough places that nobody could be confident the differences had not weakened it.

Then there was the part the specification could not reach. With no conformance regime, client implementations varied widely in their algorithm choices and their key generation, and some handsets shipped with WTLS switched off entirely. A security layer that an unknown fraction of devices does not run is not a security layer, it is an advertisement.

~ the two documents ~

Both files are still on the Open Mobile Alliance's server, in the archive it keeps of the WAP Forum's work, and reading them beside each other is the fastest way to understand the ending. The first is WAP-261-WTLS-20010406-a, titled Wireless Transport Layer Security, version dated 6 April 2001, 353 kilobytes and 106 pages of handshakes and record layer formats. It is the final, approved, finished version of the protocol.

The second is WAP-219-TLS-20010411-a, the WAP TLS Profile and Tunneling Specification, dated 11 April 2001. It is 90 kilobytes and fifteen pages, and what it does is pick a subset of ordinary TLS for use in WAP 2.0, which dropped the parallel stack and ran TCP and HTTP and real TLS like everything else on the internet. The same organization approved both documents inside one working week. WTLS was finished and superseded in five days, by its own authors.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »