Wireless Application Protocol (WAP) Layers
VOCAL’s software library Wireless Transport Layer Security (WTLS) module provides communication security with the Wireless Application Protocol (WAP). WTLS is the security layer protocol that operates above the transport layer as shown in Figure 1. Contact us to discuss your wireless application requirements.

WTLS

The primary job of WTLS is to provide privacy, data integrity and authentication between applications communicating using WAP. WTLS is based on and provides similar functionality to the Transport Layer Security (TLS) protocol but is optimized for low bandwidth mobile devices. The three major differences between TLS and WTLS are:

WTLS Primitives

WTLS has seven service Primitives listed below with their description:

The service Primitives can be one of four different types listed below with their description:

WTLS Parameters

The matrix below lists the parameters with each service Primitive and defines the requirement of the parameters
presence in each parameter type. The entries under the types across from the parameters is defined in the list before
the matrix.

Service Primitive Types Parameter Matrix
Service Primitive Parameter Parameter
Description
Primitive Types
request indication response confirm
Unitdata Source Address Identifies the originator MUST MUST* X X
Source Port Identifies the port the message is sent from MUST MUST*
Destination Address Identifies the peer user data is sent to MUST OPTION*
Destination Port Identifies the to which the data is sent MUST OPTION*
User Data The data to be transmitted MUST MUST*
Create Source Address Identifies the originator MUST MUST*
Source Port Identifies the port the message is sent from MUST MUST*
Destination Address Identifies the peer user data is sent to MUST OPTION*
Destination Port Identifies the to which the data is sent MUST OPTION*
Client Identities Independent originator identity, may be used by server to look up certificates OPTION CONDITIONAL*
Proposed Key Exchange Suites Key Exchange Suites proposed by client MUST MUST*
Proposed Cipher Suites Cipher Suites proposed by client MUST MUST*
Proposed Compression Methods Compression Methods proposed by client MUST MUST*
Sequence Number Mode Defines how the Sequence Number is used in a secure connection OPTION CONDITIONAL* MUST MUST*
Key Refresh Defines how often the encryption and protection keys are refreshed in a secure connection OPTION CONDITIONAL* MUST MUST*
Session ID Is unique per server and identifies the secure session OPTION CONDITIONAL* MUST MUST*
Selected Key Exchange Suite Identifies the Key Exchange Suite selected by the server MUST MUST*
Selected Cipher Suite Identifies the Cipher Suite selected by the server MUST MUST*
Selected Compression Method Identifies the Compression Method selected by the server MUST MUST*
Server Certificate Public-Key Certificate of the server OPTION CONDITIONAL*
Exchange Client Certificate Public-Key Certificate of the client MUST MUST*
Commit No parameters, just an empty packet
Terminate Alert Description Identifies the reason for termination MUST MUST* X X
Alert Level Defines whether the session (fatal) or connection (critical) is terminated MUST MUST*
Exception Alert Description Identifies what caused the warning MUST MUST* X X
Create-Request Source Address Identifies the originator OPTION CONDITIONAL* X X
Source Port Identifies the port the message is sent from OPTION CONDITIONAL*
Destination Address Identifies the peer user data is sent to OPTION CONDITIONAL*
Destination Port Identifies the to which the data is sent OPTION CONDITIONAL*

 

WTLS uses algorithms for Key Exchange, Encryption, and Message Authentication Code (MAC) calculations. The tables
below list the specific algorithms along with needed parameter information.

WTLS Key Exchange Suites
Key Exchange Suite Assigned Number Description Key SizeLimit
(bits)
NULL 0 No key exchange is done N/A
SHARED_SECRET 1 Symmetric-key based handshake None
DH_anon 2 Diffie-Hellman (DH) Key Exchange without authentication None
DH_anon_512 3 Diffie-Hellman (DH) Key Exchange without authentication 512
DH_anon_768 4 Diffie-Hellman (DH) Key Exchange without authentication 768
RSA_anon 5 RSA Key Exchange without authentication None
RSA_anon_512 6 RSA Key Exchange without authentication 512
RSA_anon_768 7 RSA Key Exchange without authentication 768
RSA 8 RSA Key Exchange with
RSA based certificates
None
RSA_512 9 RSA Key Exchange with
RSA based certificates
512
RSA_768 10 RSA Key Exchange with
RSA based certificates
768
ECDH_anon 11 Elliptical Curve Diffie-Hellman (ECDH) Key Exchange
without authentication
None
ECDH_anon_113 12 Elliptical Curve Diffie-Hellman (ECDH) Key Exchange
without authentication
113
ECDH_anon_131 13 Elliptical Curve Diffie-Hellman (ECDH) Key Exchange
without authentication
131
ECDH_ECDSA 14 Elliptical Curve Diffie-Hellman (ECDH) Key Exchange
with
Elliptical Curve Digital Signature Algorithm (ECDSA) Certificates
None
ECDH_anon_uncomp 15 Elliptical Curve Diffie-Hellman (ECDH) Key Exchange
without authentication where all Public keys MUST be uncompressed points
None
ECDH_anon_uncomp_113 16 Elliptical Curve Diffie-Hellman (ECDH) Key Exchange
without authentication where all Public keys MUST be
uncompressed points
113
ECDH_anon_uncomp_131 17 Elliptical Curve Diffie-Hellman (ECDH) Key Exchange
without authentication where all Public keys MUST be uncompressed points
131
ECDH_ECDSA_uncomp 18 Elliptical Curve Diffie-Hellman (ECDH) Key Exchange
with
Elliptical Curve Digital Signature Algorithm (ECDSA) Certificateswhere all Public keys MUST be uncompressed points
None

 

WTLS Bulk Cipher Suites
Cipher Assigned
Number
Description Type Key
Material
(bytes)
Expanded
Key
Material
(bytes)
Effective
Key Bits
(bits)
IV Size
(bytes)
Block Size
(bytes)
NULL 0 No encryption Stream 0 0 0 0 N/A
RC5_CBC_40 1 RC5 in CBC mode Block 5 16 40 8 8
RC5_CBC_56 2 RC5 in CBC mode Block 7 16 56 8 8
RC5_CBC 3 RC5 in CBC mode Block 16 16 128 8 8
DES_CBC_40 4 Data Encryption Standard (DES) in CBC mode Block 5 8 40 8 8
DES_CBC 5 Data Encryption Standard (DES) in CBC mode Block 8 8 56 8 8
3DES_CBC_EDE 6 3 key TripleDES in CBC mode Block 24 24 168 8 8
IDEA_CBC_40 7 IDEA in CBC mode Block 5 16 40 8 8
IDEA_CBC_56 8 IDEA in CBC mode Block 7 16 56 8 8
IDEA_CBC 9 IDEA in CBC mode Block 16 16 128 8 8
RC5_CBC_64 10 RC5 in CBC mode Block 8 16 64 8 8
IDEA_CBC_64 11 IDEA in CBC mode Block 8 16 64 8 8

 

WTLS Keyed Message Authentication Code (MAC) Algorithms
Hash
Function
Assigned
Number
Description Key
Size
(bytes)
MAC
Size
(bytes)
SHA_0 0 No keyed MAC is calculated 0 0
SHA_40 1 Keyed MAC calculated with SHA-1 but
only 1st 5 bytes of output are used
20 5
SHA_80 2 Keyed MAC calculated with SHA-1 but
only 1st half (10 bytes) of output are used
20 10
SHA 3 Keyed MAC calculated with SHA-1 20 20
MD5_40 5 Keyed MAC calculated with MD5 but
only 1st 5 bytes of output are used
16 5
MD5_80 6 Keyed MAC calculated with MD5 but
only 1st half (10 bytes) of output are used
16 10
MD5 7 Keyed MAC calculated with MD5 16 16