Subject: [TLS] J2ME and TLS

From: "Omirjan Batyrbaev" <[email-masked]>
Date: Thu, 18 Jan 2007 22:47:58 -0500

Hi,

Can somebody tell me if there is a TLS client for J2ME implementation
besides Phaos SSLava Micro? Especially if there are open source projects,
etc.?
Thanks.
-Omirjan

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: Vipul Gupta <[email-masked]>
Date: Thu, 18 Jan 2007 21:47:22 -0800

As part of Sun's open sourcing of Java, the ssl client code in MIDP  
is now available at:

https://phoneme.dev.java.net/source/browse/phoneme/builds/ 
phoneme_feature-mr1-rc-b04/restricted_crypto/src/ssl/reference/ 
classes/com/sun/midp/ssl/#dirlist

While this code does not implement TLS (only SSL 3.0), the changes  
required to add TLS functionality aren't very big. Contact me  
separately if you need help. For a description of the functionality  
implemented, refer to
http://dev.experimentalstuff.com:8082/pubs/COMSOCDec2001gupta.pdf

vipul

---

From: <[email-masked]>
Date: Fri, 19 Jan 2007 09:53:28 -0800

Vipul:

Given parts of J2ME are in the handsets of many phones, 
could you give a best estimate of just HOW many installs of 
SSLv3 your think there might be, globally, in mobile 
terminals?

This would be a fascinating number to approximate.

Do these terminals use TCP as the bearer for SSL messages, 
in general, or otherwise?

----- Original Message -----
From: "Vipul Gupta" <[email-masked]>
To: "Omirjan Batyrbaev" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, January 18, 2007 9:47 PM
Subject: Re: [TLS] J2ME and TLS

>
> As part of Sun's open sourcing of Java, the ssl client 
> code in MIDP  is now available at:

---

From: Vipul Gupta <[email-masked]>
Date: Fri, 19 Jan 2007 11:38:04 -0800

I wish I knew but this is a hard number to obtain. While I've seen  
numbers that say there are nearly a billion cellphones with Java ME  
worldwide, that doesn't directly translate into SSLv3 installs for at  
least a couple of reasons:

-- HTTPS support only became a requirement for Java ME devices  
starting with version 2.0 of MIDP (MIDP 1.0 compliance only required  
HTTP support)
-- From what I've heard, many phone set manufacturers treat the  
reference implementation as just that -- few use it as is, often  
times their underlying OS has a native SSL/TLS implementation that  
they reuse under a Java API.

I feel reasonably comfortable saying that many phones that support  
HTTP(S) do not use TCP as the underlying bearer. They just need TCP- 
like semantics -- in order, loss less delivery.

If you are interested in estimating SSLv3 v/s TLSv1 usage, here's an  
interesting data point. SSL 3.0 ends up being used more often than it  
should because many deployed servers are "TLS intolerant" due to a  
bug -- the spec says that the encrypted premaster should carry the  
highest version proposed by the client but servers with this bug  
expect the negotiated version instead causing handshake failures.  
When Mozilla/Firefox encounter such servers they abandon the failed  
TLS handshake and reconnect using SSL 3.0. I believe this bug was  
recently fixed by the MS team -- one of the nice outcomes of having  
engineering teams from various vendors being able to communicate  
directly with each other as part of the ECC interop forum (http:// 
dev.experimentalstuff.com:8082). There's also some relevant data at:
http://www.securityspace.com/s_survey/sdata/200612/protciph.html

vipul

On Jan 19, 2007, at 9:53 AM, [email-masked] wrote:

> Vipul:
>
> Given parts of J2ME are in the handsets of many phones, could you  
> give a best estimate of just HOW many installs of SSLv3 your think  
> there might be, globally, in mobile terminals?
>
> Do these terminals use TCP as the bearer for SSL messages, in  
> general, or otherwise?
>
>> As part of Sun's open sourcing of Java, the ssl client code in  
>> MIDP  is now available at:
>