Security in WAP and WTSL

By Yun Zhou

Overview of WAP (Wireless Application Protocol) Proposed by the WAP Forum (Phone.com,

Ericsson, Nokia, Motorola) in 1997. A wireless communication model, similar to the

ISO OSI model An application environment for deploying

wireless services regardless of different types of services, wireless bearers, and devices.

WAP provides a series of security measures However, there are still various security loopholes

in WAP.

WAP Architecture

Components: WAP device (cell phone), WAP client/browser, User agent, Network operator (companies that provides bearer services), Bearer services (SMS, CDMA…), Application server

WAP ProtocolsRecall the ISO OSI model:

• WAE (Wireless Application Environment): WML, WMLScript• WSP (Wireless Session Protocol) and WTP (Wireless Transaction Protocol): together provide session layer services connection oriented sessions or connectionless sessions. Reliable sessions can be resumed.• WTLS (Wireless Transport Layer Security) (Optional)

Overview of WTLS Based on TLS Provides client-server mutual authentication, privacy, data integrity, non-repudiation But not the same as TLS Modifications due to

Narrow-bandwidth communication channel Much less processing power Much less memory High loss ratio Unexpected disconnections Restrictions on exported encryption algorithms Built on top of WDP and UDP (unreliable data transfer)

More security problems

WTLS Sub-Protocols WTLS contains four sub-protocols:

Handshake protocol: Client and server negotiate over the security parameters to be used for later message exchanges Alert protocol: Specifies the types of alerts and how to handle them. warning, critical, fatal Alerts can be sent by either the client or the server. Application protocol: interface for the upper layer Change Cipher Spec Protocol: Usually used towards the end of the handshake when the negotiation succeeds

What does the handshake specify?

Handshake Procedure

Complete handshakeResume connection

How Security Functions Are Achieved Authentication: Supports X.509v3 and X9.68 certificates, optimized sizes. Key exchange: RSA, DH, ECC-DH (Preferable algorithm for WAP) Bulk encryption algorithms: RC5 with 40, 56 or 128 bit keys, DES with 40 or 56 bit keys, 3DES, IDEA

with 40, 56 or 128 bit keys, and ECC. (No stream ciphers) master_secret = PRF(pre_master_secret, "master secret", ClientHello.random + ServerHello.random)

key_block = PRF(master_secret + expansion_label + seq_num + server_random +

client_random); Keys and IVs are all generated from key_blocks.Keys are refreshed according to the negotiated frequency.

MAC algorithms: SHA-1, MD5, and SHA_XOR_40

Security Loopholes, Threats, Solutions - WAP Gateway Decrypts and re-encrypts data – “White spot” End-to-end security, but the ends are actually the web client and the gateway. Solution by the network operators:

Decrypts and re-encrypts only in the memory Cannot solve the problem entirely: still uses swapfiles, hackers can do core dumps Some companies try to completely get rid of the WAP gateway.

Deploy the Gateway in the Server’s network

Decryption and re-encryption are done on the server side.

Security Loopholes, Threats, Solutions - WTLS Has to use keys of small sizes: 40-bit DES -> 35 bits are actually used Allows weak algorithms to be chosen exchanges unauthorized messages or unencrypted packet

fields, such as alert messages and recode_type field. Vulnerable to viruses, Trojan horses, and worms. Saarinen discussed a chosen plaintext data recovery

attack, a datagram truncation attack, a message forgery attack, and a key-search shortcut for some exportable keys

Attack against SHA_XOR_40 SHA_XOR_40: Padded messages are divided into 5-byte

blocks. All blocks are XOR’ed to get the digest.

Attack: Flip a bit in one block, flip the bit in the corresponding position in the digestTada! Message modification succeeds!

User Authentication vs. Device

Authentication - WIM Mobile devices are easy to lose One British article reported that “for the first time of this

century the umbrella has been overtaken as the most popular item to leave on a train — by mobile phones”.

Cannot authenticate user if the passwords and certificates are stored locally Use WIM (Wireless Identity Module), which can be a smart

card or a SIM card. Dedicated memory Provides user authentication Need to keep it separately from the device. Hard to achieve.

ReferencesArehart, C., Professional WAP, Wrox Press Ltd, 2000.Jormalainen, S., Laine, J. “Security in WTLS”, 10/1/2000.

Referred on 3/24/2004], <http://www.hut.fi/~jtlaine2/wtls/>Nicolas, R., Lekkas, P. Wireless security : models, threats, and

solutions. McGraw-Hill. 2002.Saarinen, Markku-Juhani, “Attacks against the WAP WTLS

Protocol”, 9/221999 [Referred on 3/24/2004], < http://www.jyu.fi/~mjos/wtls.pdf>

Schneier, B., Applied Cryptography, Second Edition, John Wiley & Sons, Inc, p. 758, 1996.

WAP Forum, “WAP Security Group (WSG) Charter”, 6/12/2002 [Referred on 3/24/2004].