Datagram Transport Layer Security

Not to be confused with TDLS.

Datagram Transport Layer Security (DTLS) is a communications protocol providing security to datagram-based applications by allowing them to communicate in a way designed[1][2][3] to prevent eavesdropping, tampering, or message forgery. The DTLS protocol is based on the stream-oriented Transport Layer Security (TLS) protocol and is intended to provide similar security guarantees. The DTLS protocol datagram preserves the semantics of the underlying transport—the application does not suffer from the delays associated with stream protocols, but because it uses User Datagram Protocol (UDP) or Stream Control Transmission Protocol (SCTP), the application has to deal with packet reordering, loss of datagram and data larger than the size of a datagram network packet. Because DTLS uses UDP or SCTP rather than TCP it avoids the TCP meltdown problem[4][5] when being used to create a VPN tunnel.

Definition

The following documents define DTLS:

  • RFC 5238 from May 2008[6] for use with Datagram Congestion Control Protocol (DCCP)
  • RFC 5415 from March 2009[7] for use with Control And Provisioning of Wireless Access Points (CAPWAP)
  • RFC 5764 from May 2010[8] for use with Secure Real-time Transport Protocol (SRTP) subsequently called DTLS-SRTP in a draft with Secure Real-Time Transport Control Protocol (SRTCP)[9]
  • RFC 6083 from January 2011[10] for use with Stream Control Transmission Protocol (SCTP) encapsulation
  • RFC 9147 from April 2022[3] for use with User Datagram Protocol (UDP)

DTLS 1.0 is based on TLS 1.1, DTLS 1.2 is based on TLS 1.2, and DTLS 1.3 is based on TLS 1.3. There is no DTLS 1.1 because this version-number was skipped in order to harmonize version numbers with TLS.[2] Like previous DTLS versions, DTLS 1.3 is intended to provide "equivalent security guarantees [to TLS 1.3] with the exception of order protection/non-replayability".[11]

Implementations

Libraries

Main article: Comparison of TLS implementations § Protocol support
Library support for DTLS
Implementation DTLS 1.0[1] DTLS 1.2[2] DTLS 1.3[3]
Botan Yes Yes
cryptlib No No
GnuTLS Yes Yes
Java Secure Socket Extension Yes Yes
LibreSSL Yes Yes[12]
libsystools[13] Yes No
MatrixSSL Yes Yes
mbed TLS (previously PolarSSL) Yes[14] Yes[14]
Network Security Services Yes[15] Yes[16]
OpenSSL Yes Yes[17]
PyDTLS[18][19] Yes Yes
Python3-dtls[20][21] Yes Yes
RSA BSAFE No No
s2n No No
Schannel XP/2003, Vista/2008 No No
Schannel 7/2008R2, 8/2012, 8.1/2012R2, 10 Yes[22] No[22]
Schannel 10 (1607), 2016 Yes Yes[23]
Secure Transport OS X 10.2–10.7 / iOS 1–4 No No
Secure Transport OS X 10.8–10.10 / iOS 5–8 Yes[24] No
SharkSSL No No
tinydtls [25] No Yes
Waher.Security.DTLS [26] No Yes
wolfSSL (previously CyaSSL)[27] Yes Yes Yes
@nodertc/dtls [28][29] No Yes
java-dtls[30] Yes Yes
pion/dtls[31] (Go) No Yes
californium/scandium[32] (Java) No Yes
SNF4J[33] (Java) Yes Yes
Implementation DTLS 1.0 DTLS 1.2 DTLS 1.3

Applications

  • Cisco AnyConnect VPN Client uses TLS and invented DTLS-based VPN.[34]
  • OpenConnect is an open source AnyConnect-compatible client and ocserv server that supports (D)TLS.[35]
  • Cisco InterCloud Fabric uses DTLS to form a tunnel between private and public/provider compute environments.[36]
  • Cato Networks utilizes DTLS v1.2 for the underlay tunnel used by both the Cato Socket and Cato ZTNA (formerly SDP) client when forming tunnels to the Cato POPs [37] and when forming off-cloud tunnels between Cato sockets.[38]
  • ZScaler tunnel 2.0 uses DTLS for tunneling.[39]
  • F5 Networks Edge VPN Client uses TLS and DTLS.[40]
  • Fortinet's SSL VPN[41] and Array Networks SSL VPN[42] also use DTLS for VPN tunneling.
  • Citrix Systems NetScaler uses DTLS to secure UDP.[43]
  • Web browsers: Google Chrome, Opera and Firefox support DTLS-SRTP[44] for WebRTC. Firefox 86 and onward does not support DTLS 1.0.[45]
  • Remote Desktop Protocol 8.0 and onwards.

Vulnerabilities

In February 2013 two researchers from Royal Holloway, University of London discovered a timing attack[46] which allowed them to recover (parts of the) plaintext from a DTLS connection using the OpenSSL or GnuTLS implementation of DTLS when Cipher Block Chaining mode encryption was used.

See also

References

  1. ^ a b E. Rescorla; N. Modadugu (April 2006). Datagram Transport Layer Security. Network Working Group. doi:10.17487/RFC4347. RFC 4347. Obsolete. Obsoleted by RFC 6347. Updated by RFC 5746 and 7507.
  2. ^ a b c E. Rescorla; N. Modadugu (January 2012). Datagram Transport Layer Security Version 1.2. Internet Engineering Task Force. doi:10.17487/RFC6347. ISSN 2070-1721. RFC 6347. Obsolete. Obsoleted by RFC 9147. Updated by RFC 7507, 7905, 8996 and 9146. Obsoletes RFC 4347.
  3. ^ a b c E. Rescorla; H. Tschofenig; N. Modadugu (April 2022). The Datagram Transport Layer Security (DTLS) Protocol Version 1.3. IETF TLS workgroup. doi:10.17487/RFC9147. RFC 9147. Proposed Standard. Obsoletes RFC 6347
  4. ^ Titz, Olaf (2001-04-23). "Why TCP Over TCP Is A Bad Idea". Archived from the original on 2023-03-10. Retrieved 2015-10-17.{{cite web}}: CS1 maint: bot: original URL status unknown (link)
  5. ^ Honda, Osamu; Ohsaki, Hiroyuki; Imase, Makoto; Ishizuka, Mika; Murayama, Junichi (October 2005). "Understanding TCP over TCP: effects of TCP tunneling on end-to-end throughput and latency". In Atiquzzaman, Mohammed; Balandin, Sergey I (eds.). Performance, Quality of Service, and Control of Next-Generation Communication and Sensor Networks III. Vol. 6011. Bibcode:2005SPIE.6011..138H. CiteSeerX 10.1.1.78.5815. doi:10.1117/12.630496. S2CID 8945952.
  6. ^ T. Phelan (May 2008). Datagram Transport Layer Security (DTLS) over the Datagram Congestion Control Protocol (DCCP). Network Working Group. doi:10.17487/RFC5238. RFC 5238. Informational. Updated by RFC 8996.
  7. ^ P. Calhoun; M. Montemurro; D. Stanley, eds. (March 2009). Control And Provisioning of Wireless Access Points (CAPWAP) Protocol Specification. Network Working Group. doi:10.17487/RFC5415. RFC 5415. Proposed Standard. Updated by RFC 8553 and 8996.
  8. ^ D. McGrew; E. Rescorla (May 2010). Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP). Internet Engineering Task Force. doi:10.17487/RFC5764. ISSN 2070-1721. RFC 5764. Proposed Standard. Updated by RFC 7983 and 9443.
  9. ^ Peck, M.; Igoe, K. (2012-09-25). "Suite B Profile for Datagram Transport Layer Security / Secure Real-time Transport Protocol (DTLS-SRTP)". IETF.
  10. ^ M. Tuexen; R. Seggelmann; E. Rescorla (January 2011). Datagram Transport Layer Security (DTLS) for Stream Control Transmission Protocol (SCTP). Internet Engineering Task Force (IETF). doi:10.17487/RFC6083. ISSN 2070-1721. RFC 6083. Proposed Standard. Updated by RFC 8996.
  11. ^ "The Datagram Transport Layer Security (DTLS) Protocol Version 1.3".
  12. ^ "LibreSSL 3.3.2 Release Notes". The OpenBSD Project. 2021-05-01. Retrieved 2021-06-13.
  13. ^ Julien Kauffmann. "libsystools: A TLS/DTLS open source library for Windows/Linux using OpenSSL". SourceForge.
  14. ^ a b "mbed TLS 2.0.0 released". ARM. 2015-07-13. Retrieved 2015-08-25.
  15. ^ "NSS 3.14 release notes". Mozilla Developer Network. Mozilla. Archived from the original on 2013-01-17. Retrieved 2012-10-27.
  16. ^ "NSS 3.16.2 release notes". Mozilla Developer Network. Mozilla. 2014-06-30. Archived from the original on 2021-12-07. Retrieved 2014-06-30.
  17. ^ "As of version 1.0.2". The OpenSSL Project. The OpenSSL Project. 2015-01-22. Archived from the original on 2014-09-04. Retrieved 2015-01-26.
  18. ^ Ray Brown. "pydtls - Datagram Transport Layer Security for Python". GitHub.
  19. ^ Ray Brown. "DTLS for Python". Python Software Foundation.
  20. ^ Ray Brown/Mobius Software LTD. "pydtls - Datagram Transport Layer Security for Python". GitHub.
  21. ^ Ray Brown/Mobius Software LTD. "DTLS for Python3 Based on PyDTLS". Python Software Foundation.
  22. ^ a b "An update is available that adds support for DTLS in Windows 7 SP1 and Windows Server 2008 R2 SP1". Microsoft. Retrieved 13 November 2012.
  23. ^ Justinha. "TLS (Schannel SSP) changes in Windows 10 and Windows Server 2016". docs.microsoft.com. Retrieved 2017-09-01.
  24. ^ "Technical Note TN2287: iOS 5 and TLS 1.2 Interoperability Issues". iOS Developer Library. Apple Inc. Retrieved 2012-05-03.
  25. ^ Olaf Bergmann. "tinydtls". Eclipse Foundation.
  26. ^ Peter Waher. "Waher.Security.DTLS". Waher Data AB.
  27. ^ "wolfSSL Embedded SSL/TLS Library".
  28. ^ Dmitriy Tsvettsikh. "Secure UDP communications using DTLS in pure js". GitHub.
  29. ^ Dmitriy Tsvettsikh. "DTLS in pure js". npm.
  30. ^ Mobius Software LTD. "Non blocking Java DTLS Implementation based on BouncyCastle and Netty". Mobius Software LTD.
  31. ^ Sean DuBois. "pion/dtls: DTLS 1.2 Server/Client implementation for Go". GitHub.
  32. ^ "californium/scandium: DTLS 1.2 Server/Client implementation for java and coap. Includes connection id extension". Eclipse Foundation.
  33. ^ SNF4J.ORG. "Simple Network Framework for Java (SNF4J)". GitHub.{{cite web}}: CS1 maint: numeric names: authors list (link)
  34. ^ "AnyConnect FAQ: tunnels, reconnect behavior, and the inactivity timer". Cisco. Retrieved 26 February 2017.
  35. ^ "OpenConnect". OpenConnect. Retrieved 26 February 2017.
  36. ^ "Cisco InterCloud Architectural Overview" (PDF). Cisco Systems.
  37. ^ "Cato Networks Cipher Suites Used by the Cato Socket and SDP Client".{{cite web}}: CS1 maint: url-status (link)
  38. ^ "Cato Networks Routing Traffic to an Off-Cloud Link".{{cite web}}: CS1 maint: url-status (link)
  39. ^ "ZScaler ZTNA 2.0 Tunnel". ZScaler.
  40. ^ "f5 Datagram Transport Layer Security (DTLS)". f5 Networks.
  41. ^ "Using DTLS to improve SSL VPN performance". Fortinet. 25 February 2016.
  42. ^ "array.c from OpenConnect". 23 May 2022.
  43. ^ "Configuring a DTLS Virtual Server". Citrix Systems.
  44. ^ "WebRTC Interop Notes". Archived from the original on 2013-05-11.
  45. ^ "Firefox 86.0, See All New Features, Updates and Fixes". Mozilla. 2021-02-23. Archived from the original on 2021-02-22. Retrieved 2021-02-23. From Firefox 86 onward, DTLS 1.0 is no longer supported for establishing WebRTC's PeerConnections. All WebRTC services need to support DTLS 1.2 from now on as the minimum version.
  46. ^ "Plaintext-Recovery Attacks Against Datagram TLS" (PDF).

Read other articles:

Johann Cochlaeus

Johann Cochlaeus Johann Cochlaeus o italianizzato Giovanni Cocleo, pseudonimo di Johann Dobneck (Wendelstein, 1479 – Breslavia, 10 gennaio 1552) è stato un teologo e umanista tedesco. Indice 1 Biografia 2 Opere principali 3 Note 4 Bibliografia 5 Altri progetti 6 Collegamenti esterni Biografia Johann Cochlaeus nacque nel 1479 a Wendelstein presso Norimberga. Educato nella città natale sotto la guida dell'umanista Heinrich Grieninger, passò nel 1504 all'Università di Colonia, dove divenne...

 

4 августа

←→Август Пн Вт Ср Чт Пт Сб Вс   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31       2023 год Содержание 1 Праздники и памятные дни 1.1 Национальные 1.2 Профессиональные 1.3 Религиозные 1.4 Именины 2 События 2.1 До XX века 2.2 XX век 2.3 XXI век 3 Родились 3.1 До XIX века 3.2 XIX век 3.3 XX век 4...

 

45-я гвардейская стрелковая дивизия

Для термина «45-я дивизия» см. также другие значения. 45-я гвардейская стрелковая дивизия (45-я гв. сд) Вооружённые силы ВС СССР Вид вооружённых сил сухопутные Род войск (сил) пехота Почётные наименования Красносельская Формирование 16 октября 1942 года Расформирование (преобраз

Four Evangelists

Authors of the Gospels in the New Testament For the painting, see The Four Evangelists (painting). See also: Synoptic gospels This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed.Find sources: Four Evangelists – news · newspapers · books · scholar · JSTOR (July 2022) (Learn how and when to remove this template message) Jacob J...

 

Piramide 'e Cheope

Piramide 'e CheopeGranne Piramide'A Piramide 'e CheopeLocalizzazioneStato NaggittoGuviernaturatoGizaCoordinate29°58′45″N 31°08′03″EAltitudine60 m n.l.m.DimensiuneSuperficie53077 m²Larghezza230,36 mNclinazzione51° 50' 40''AmmenistrazionePatrimmonioMenfiEnteMinistry of State for AntiquitiesPiramide 'e Cheope 'A Granna Piramide 'e Giza, canusciuta pure comme 'a Piramide 'e Cheope o 'a Piramide 'e Khufu, è 'a cchiù antica e 'a cchiù granna de tre piramide da necropoli 'e Giza, cunf...

 

مذيع

مذيع تسمية الإناث مذيعة  فرع من مبدع  [لغات أخرى]‏  تعديل مصدري - تعديل   مذيعة تقدم نشرة الاخبار يقال المذيع للرجل والمذيعة للمرأة (الانجليزية : Television Presenter).[1] وهو المحترف الذي يعمل في الإعلام سواء في الإذاعة أو التلفاز ويقدم البرامج أو يقرأ النشرات الإخ

Dedumose II

Ancient Egyptian pharaoh Dedumose IIDudimose, TutimaiosStele CG 20533 of Djedneferre Dedumose II from Gebelein.[1]PharaohReignsome time between 1588 BC and 1582 BC (Ryholt)PredecessorDedumose I?SuccessorDjedankhre Montemsaf?Royal titulary Prenomen  (Praenomen) Djedneferre Ḏd-nfr-RˁEnduring and perfect is Ra Nomen Dedumose Dd-msw[A god] has fashioned/given him Turin canon: Uncertain, column 7 line 13 FatherDedumose I?Dynasty16th Dynasty (Ryholt, Baker) or 13th Dynasty (von...

 

Materia orgánica

Esquema del suelo:O - Materia orgánicaA - SueloB - SubsueloC - Material parental La materia orgánica (o material orgánico, material orgánico natural o MON) es materia conformada por compuestos orgánicos que provienen de los restos de organismos que alguna vez estuvieron vivos, tales como plantas, animales y sus productos de residuo en el ambiente natural. Las estructuras básicas están formadas de celulosa, tanino, cutina y lignina, junto con varias otras proteínas, lípidos y azúcare...

 

Canon EOS M5

Digital camera Canon EOS M5OverviewMakerCanon Inc.TypeMirrorless interchangeable lens cameraIntro price$979.99LensLens mountCanon EF-MSensor/mediumSensordual-pixel CMOS sensorSensor size22.3 mm × 14.9 mm (APS-C)Maximum resolution24.2 MPFilm speedISO 100-25600Recording mediumSDXC (UHS-I capable)FocusingFocusDual Pixel CMOS autofocusShutterFrame rate9 fps; 7 fps with autofocusShutter speeds30 s to 1/4000 sViewfinderViewfinder2.36-million dot OLED EVFImage pro...

Escuela Municipal de Bellas Artes de Viña del Mar

Escuela Municipal de Bellas Artes de Viña del MarLocalizaciónPaís  ChileCoordenadas 33°01′59″S 71°32′00″O / -33.032941195073, -71.533322615344InformaciónFundación 1935[editar datos en Wikidata] La Escuela Municipal de Bellas Artes de Viña del Mar es un centro de formación artístico ubicado en la ciudad de Viña del Mar, Chile. Sus orígenes datan del año 1935 cuando, tras la propuesta de un grupo de ciudadanos, el alcalde Sergio Prieto Nieto e...

 

مادة لابلورية

البنية اللابلورية للسيليكا(SiO2). المادة اللابلورية هي مادة صلبة لا تتوزع فيها الذرات توزيعًا منتظمًا في شبكة بلورية، وإنما يكون توزيع الذرات فيها عشوائيا ولكن على مسافات تكاد تكون متساوية، بمعنى أن توزيع الذرات فيها لا يتبع أي نظام من الأنظمة البلورية.[1][2][3] تو...

 

Agência Internacional de Energia Atómica

Coordenadas: 48° 14' 8 N 16° 24' 51 E  Nota: Se procura pela Região censo-designada, veja Aiea (Havaí). Esta página cita fontes, mas que não cobrem todo o conteúdo. Ajude a inserir referências. Conteúdo não verificável pode ser removido.—Encontre fontes: ABW  • CAPES  • Google (N • L • A) (Junho de 2019) Agência Internacional de Energia Atómica Agência Internacional de Energia AtómicaBandeira d...

West Yorkshire Police

English territorial police force Not to be confused with predecessor police force West Yorkshire Constabulary. West Yorkshire PoliceMottoIn the Public ServiceAgency overviewFormed1974Preceding agenciesWest Yorkshire ConstabularyLeeds City PoliceBradford City PoliceEmployees9,853Volunteers403[1]Annual budget£396.0 million[1]Legal personalityPolice forceJurisdictional structureOperations jurisdictionWest Yorkshire, EnglandMap of West Yorkshire Police's jurisdictionSize2,029 squ...

 

List of media adaptations of Journey to the West

Depiction of the Forbidden Temple's Sun Wukong as depicted in a scene in a Beijing opera. The pilgrims Sun Wukong, Tang Sanzang, Zhu Bajie, and Sha Wujing at Western Paradise in production The Monkey Sun (Theatre Esence, 1984). Journey to the West, one of the Four Great Classical Novels of Chinese literature, was written in the 16th century and attributed to Wu Cheng'en. Stories and characters were widely used, especially in Beijing opera, and has been adapted many times in modern film, telev...

 

McMinnville, Tennessee

City in Tennessee, United StatesMcMinnville, TennesseeCityCourthouse SquareLocation of McMinnville in Warren County, Tennessee.Coordinates: 35°41′12″N 85°46′46″W / 35.68667°N 85.77944°W / 35.68667; -85.77944CountryUnited StatesStateTennesseeCountyWarrenFoundedAugust 4, 1810Incorporated1868[1]Named forJoseph McMinnGovernment • TypeMayor and Board of Aldermen • MayorRyle ChastainArea[2] • Total11.06 sq&...

Adrian Ross

For the NFL player, see Adrian Ross (American football). Ross in 1904 Arthur Reed Ropes (23 December 1859 – 11 September 1933), better known under the pseudonym Adrian Ross, was a prolific writer of lyrics, contributing songs to more than sixty British musical comedies in the late 19th and early 20th centuries. He was the most important lyricist of the British stage during a career that spanned five decades. At a time when few shows had long runs, nineteen of his West End shows ran for over...

 

Ross Park Mall

This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages) This article relies largely or entirely on a single source. Relevant discussion may be found on the talk page. Please help improve this article by introducing citations to additional sources.Find sources: Ross Park Mall – news · newspapers · books · scholar · JSTOR (August 2016) This article possibly ...

 

ProSieben Fun

Television channel ProSieben FunCountryGermanyBroadcast areaGermany, SwitzerlandNetworkProSiebenHeadquartersUnterföhring, GermanyProgrammingLanguage(s)GermanPicture format576i (16:9 SDTV)1080i (HDTV)OwnershipOwnerProSiebenSat.1 MediaSister channelsProSiebenProSieben Maxxkabel einskabel eins Dokukabel eins classicsSat.1Sat.1 EmotionsSat.1 GoldsixxHistoryLaunched3 May 2012; 11 years ago (2012-05-03)LinksWebsitewww.prosiebenfun.deAvailabilityStreaming mediaMagine TV (Germany)-...

Me Against Myself

2004 studio album by Jay SeanMe Against MyselfStudio album by Jay SeanReleased8 November 2004Recorded2003–2004GenreR&BBhangrahip hopLabel2Point9RelentlessVirginProducerRishi Rich (co-exec.)Jay Sean (co-exec.)MentorIceman JStargatePaul BrownFitzgerald ScottPeter BikerKarsten Delgado DahlgaardJay Sean chronology Me Against Myself(2004) My Own Way(2008) Singles from Me Against Myself Dance with YouReleased: 8 September 2003 Eyes on YouReleased: 21 June 2004 StolenReleased: 25 Octob...

 

St. Andrew's Scots Church, Malta

Church in Valletta, MaltaSt Andrew's Scots ChurchSaint Andrew's Scots Church, A Union of the Church of Scotland and the Methodist Church of England, South East DistrictSaint Andrew's International ChurchSt. Andrew's Scots ChurchSt Andrew's Scots Church35°53′51.4″N 14°30′35.3″E / 35.897611°N 14.509806°E / 35.897611; 14.509806LocationVallettaCountryMaltaDenominationChurch of Scotland (Presbyterian)Methodist Church of Great BritainWebsiteWebsite of the Church...

 

Strategi Solo vs Squad di Free Fire: Cara Menang Mudah!