WTLS -Certificates

diff -r 48780e181b38 -r 578be2adaf3e Symbian3/PDK/Source/GUID-A636C1B3-8AB2-52D7-BB19-4CC93F4BDD97.dita --- a/Symbian3/PDK/Source/GUID-A636C1B3-8AB2-52D7-BB19-4CC93F4BDD97.dita Tue Jul 20 12:00:49 2010 +0100 +++ b/Symbian3/PDK/Source/GUID-A636C1B3-8AB2-52D7-BB19-4CC93F4BDD97.dita Fri Aug 13 16:47:46 2010 +0100 @@ -1,70 +1,70 @@ - - - - - -WTLS -Certificates -

Wireless Transport Layer Security (WTLS) certificates are used for authenticating -entities in WTLS, the security layer protocol in the WAP architecture. The -WTLS specification [WTLS 1.0], defines the certificate and its use, as well -as the protocol itself.

The WTLS protocol is heavily based on TLS [RFC 2246], which is widely used -to provide privacy and data integrity between two applications communicating -using the Internet. In turn, TLS is heavily based on SSL version 3.0.

All these protocols use Public -Key Cryptography to achieve the goals of privacy and data integrity. -Public Key Cryptography is used to reduce the problem of how to achieve these -goals from a secrecy requirement to a requirement of authentication. That -is, given two entities A and B, if A can demonstrate possession of the private -key corresponding to the public key which it supplies, and B can do the same, -then the use of Public Key Cryptography will enable them to communicate privately. Certificates are used -to demonstrate this possession: the prover will supply a set of certificates -beginning with their own, and the verifier will attempt to construct and validate -a chain beginning with the prover's own certificate and terminating in a certificate -already trusted by the verifier.

Three levels of security are provided by WTLS:

no authentication: anonymous -key exchange is used for creation of an encrypted channel between server and -client; no authentication takes place, so no certificate management is required.
server authentication: -the server provides a certificate mapping back to an entity trusted by the -client, enabling the client to authenticate the server. This is often all -the authentication that is required; for online shopping, for example, the -client will generally authenticate the server but the reverse will often not -be necessary since the client will supply their credit card number to pay -for the stuff, which is all the server usually cares about.
client authentication: -the client possesses its own private key and associated public key certificate -which it may use to identify itself to other entities in the network.

For server authentication WTLS certificates are used: thus, WAP clients -do not have to deal with X.509 certificates. However, for client authentication -X.509 certificates are used to leverage existing PKIs.

The Symbian platform support for TLS/SSL and WTLS certificate -management only includes server authentication. Thus, the WTLS certificate -management only offers support for the validation of chains composed exclusively -of WTLS certificates, and the storage of WTLS certificates.

The Certificate and Key Management component offers the following functionality -for processing WTLS certificates:

parses a set of WTLS -certificates sent from the server from their binary encoded form into a form -in which they are useful, and in which client code can extract interesting -information (for example name information).
uses these certificates -to construct a chain back to a locally stored trusted root certificate.
validates this chain: -this would include verifying the signature and validity dates on each certificate.
maintains a local store -of certificates, with trust settings for each one, and offering an API to -edit these trust settings, and add and delete certificates.

+ + + + + +WTLS +Certificates +

Wireless Transport Layer Security (WTLS) certificates are used for authenticating +entities in WTLS, the security layer protocol in the WAP architecture. The +WTLS specification [WTLS 1.0], defines the certificate and its use, as well +as the protocol itself.

The WTLS protocol is heavily based on TLS [RFC 2246], which is widely used +to provide privacy and data integrity between two applications communicating +using the Internet. In turn, TLS is heavily based on SSL version 3.0.

All these protocols use Public +Key Cryptography to achieve the goals of privacy and data integrity. +Public Key Cryptography is used to reduce the problem of how to achieve these +goals from a secrecy requirement to a requirement of authentication. That +is, given two entities A and B, if A can demonstrate possession of the private +key corresponding to the public key which it supplies, and B can do the same, +then the use of Public Key Cryptography will enable them to communicate privately. Certificates are used +to demonstrate this possession: the prover will supply a set of certificates +beginning with their own, and the verifier will attempt to construct and validate +a chain beginning with the prover's own certificate and terminating in a certificate +already trusted by the verifier.

Three levels of security are provided by WTLS:

no authentication: anonymous +key exchange is used for creation of an encrypted channel between server and +client; no authentication takes place, so no certificate management is required.
server authentication: +the server provides a certificate mapping back to an entity trusted by the +client, enabling the client to authenticate the server. This is often all +the authentication that is required; for online shopping, for example, the +client will generally authenticate the server but the reverse will often not +be necessary since the client will supply their credit card number to pay +for the stuff, which is all the server usually cares about.
client authentication: +the client possesses its own private key and associated public key certificate +which it may use to identify itself to other entities in the network.

For server authentication WTLS certificates are used: thus, WAP clients +do not have to deal with X.509 certificates. However, for client authentication +X.509 certificates are used to leverage existing PKIs.

The Symbian platform support for TLS/SSL and WTLS certificate +management only includes server authentication. Thus, the WTLS certificate +management only offers support for the validation of chains composed exclusively +of WTLS certificates, and the storage of WTLS certificates.

The Certificate and Key Management component offers the following functionality +for processing WTLS certificates:

parses a set of WTLS +certificates sent from the server from their binary encoded form into a form +in which they are useful, and in which client code can extract interesting +information (for example name information).
uses these certificates +to construct a chain back to a locally stored trusted root certificate.
validates this chain: +this would include verifying the signature and validity dates on each certificate.
maintains a local store +of certificates, with trust settings for each one, and offering an API to +edit these trust settings, and add and delete certificates.

\ No newline at end of file