3

Please excuse my probably gross misunderstanding of how all this works.

I just started reading SSL & TLS Essentials by Stephen Thomas, and in chapter 1 he talks about how TLS is a separate protocol layer below the HTTP application protocol, and since it is a separate layer, different application protocols may use it (such as FTP).

My question then is if wireless devices use HTTP (they do right?), why do we need a separate protocol for WTLS? Why can't regular TLS be used for wireless devices using HTTP just as it can with wired devices using HTTP?

According to Wikipedia, WTLS is part of the Wireless Application Protocol (WAP) stack, but again if TLS can be used in conjunction with multiple application protocols, why couldn't TLS be used with WAP?

2
  • 4
    You could use TLS on a wireless device, it's just that WTLS works better. The Wikipedia article explains: "WTLS is derived from TLS. WTLS uses similar semantics adapted for a low bandwidth mobile device."
    – paj28
    May 16, 2014 at 15:15
  • Ok that makes sense. But if TLS can be optimized for lower bandwidth scenarios like this, why not adopt these optimizations into the TLS protocol itself?
    – Adam Johns
    May 16, 2014 at 15:51

2 Answers 2

8

WTLS is a derivative of TLS with optimizations for size, especially for the handshake messages (suppression of redundancies, more efficient encoding, compression...). WTLS also tries to be more "packet-friendly" (TLS works over a bidirectional stream and ignores any notion of packet, thus it breaks data into records based on its on internal needs; WTLS tries to make the TLS-like layer more aware of the size of individual underlying packets).

Apparently WTLS has been superseded with "plain TLS"; so says this document (slide 19). I guess that the purported optimizations where not really effective in practice.

Also, there is a more standard packet-aware TLS derivative called DTLS.

3

But if TLS can be optimized for lower bandwidth scenarios like this, why not adopt these optimizations into the TLS protocol itself?
It has, using Elliptic-Curve cryptography. From RFC 4492:

Elliptic Curve Cryptography (ECC) is emerging as an attractive public-key cryptosystem, in particular for mobile (i.e., wireless) environments. Compared to currently prevalent cryptosystems such as RSA, ECC offers equivalent security with smaller key sizes.

3
  • So what is the need for DTLS mentioned by Tom if these optimizations are now in TLS? Just a TLS solution for UDP?
    – Adam Johns
    May 16, 2014 at 19:45
  • Apparently ECC is not enough, hence the main differences between TLS and WTLS mentioned above. WTLS itself does support ECC cipher suites.
    – automaton
    May 16, 2014 at 20:26
  • @AdamJohns Yes, DTLS is pretty much TLS for UDP. TLS assumes a reliable stream as transport, DTLS allows unreliable packets. May 19, 2014 at 9:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .