Menu
Home Explore People Places Arts History Plants & Animals Science Life & Culture Technology
On this page
Datagram Transport Layer Security
Communications protocol

Datagram Transport Layer Security (DTLS) is a communications protocol providing security to datagram-based applications by allowing them to communicate in a way designed to prevent eavesdropping, tampering, or message forgery. The DTLS protocol is based on the stream-oriented Transport Layer Security (TLS) protocol and is intended to provide similar security guarantees. The DTLS protocol datagram preserves the semantics of the underlying transport—the application does not suffer from the delays associated with stream protocols, but because it uses User Datagram Protocol (UDP) or Stream Control Transmission Protocol (SCTP), the application has to deal with packet reordering, loss of datagram and data larger than the size of a datagram network packet. Because DTLS uses UDP or SCTP rather than TCP it avoids the TCP meltdown problem when being used to create a VPN tunnel.

We don't have any images related to Datagram Transport Layer Security yet.
We don't have any YouTube videos related to Datagram Transport Layer Security yet.
We don't have any PDF documents related to Datagram Transport Layer Security yet.
We don't have any Books related to Datagram Transport Layer Security yet.
We don't have any archived web articles related to Datagram Transport Layer Security yet.

Definition

The following documents define DTLS:

DTLS 1.0 is based on TLS 1.1, DTLS 1.2 is based on TLS 1.2, and DTLS 1.3 is based on TLS 1.3. There is no DTLS 1.1 because this version-number was skipped in order to harmonize version numbers with TLS.12 Like previous DTLS versions, DTLS 1.3 is intended to provide "equivalent security guarantees [to TLS 1.3] with the exception of order protection/non-replayability".13

Implementations

Libraries

Main article: Comparison of TLS implementations § Protocol support

Library support for DTLS
ImplementationDTLS 1.014DTLS 1.215DTLS 1.316
BotanYesYes
cryptlibNoNo
GnuTLSYesYes
Java Secure Socket ExtensionYesYes
LibreSSLYesYes17
libsystools18YesNo
MatrixSSLYesYes
mbed TLS (previously PolarSSL)Yes19Yes20
Network Security ServicesYes21Yes22
OpenSSLYesYes23
PyDTLS2425YesYes
Python3-dtls2627YesYes
RSA BSAFENoNo
s2nNoNo
Schannel XP/2003, Vista/2008NoNo
Schannel 7/2008R2, 8/2012, 8.1/2012R2, 10Yes28No29
Schannel 10 (1607), 2016YesYes30
Secure Transport OS X 10.2–10.7 / iOS 1–4NoNo
Secure Transport OS X 10.8–10.10 / iOS 5–8Yes31No
SharkSSLNoNo
tinydtls 32NoYes
Waher.Security.DTLS 33NoYes
wolfSSL (previously CyaSSL)34YesYesYes
@nodertc/dtls 3536NoYes
java-dtls37YesYes
pion/dtls38 (Go)NoYes
californium/scandium39 (Java)NoYes
SNF4J40 (Java)YesYes
ImplementationDTLS 1.0DTLS 1.2DTLS 1.3

Applications

  • Cisco AnyConnect VPN Client uses TLS and invented DTLS-based VPN.41
  • OpenConnect is an open source AnyConnect-compatible client and ocserv server that supports (D)TLS.42
  • Cisco InterCloud Fabric uses DTLS to form a tunnel between private and public/provider compute environments.43
  • Cato Networks utilizes DTLS v1.2 for the underlay tunnel used by both the Cato Socket and Cato ZTNA (formerly SDP) client when forming tunnels to the Cato POPs 44 and when forming off-cloud tunnels between Cato sockets.45
  • ZScaler tunnel 2.0 for ZScaler Internet Access (ZIA) uses DTLS for tunneling. ZScaler Private Access (ZPA) does not support DTLS 46
  • F5 Networks Edge VPN Client uses TLS and DTLS.47
  • Fortinet's SSL VPN48 and Array Networks SSL VPN49 also use DTLS for VPN tunneling.
  • Citrix Systems NetScaler uses DTLS to secure UDP.50
  • Web browsers: Google Chrome, Opera and Firefox support DTLS-SRTP51 for WebRTC. Firefox 86 and onward does not support DTLS 1.0.52
  • Remote Desktop Protocol 8.0 and onwards.

Vulnerabilities

In February 2013 two researchers from Royal Holloway, University of London discovered a timing attack53 which allowed them to recover (parts of the) plaintext from a DTLS connection using the OpenSSL or GnuTLS implementation of DTLS when Cipher Block Chaining mode encryption was used.

See also

  • Internet portal

References

  1. E. Rescorla; N. Modadugu (April 2006). Datagram Transport Layer Security. Network Working Group. doi:10.17487/RFC4347. RFC 4347. Obsolete. Obsoleted by RFC 6347. Updated by RFC 5746 and 7507. https://datatracker.ietf.org/doc/html/rfc4347 ↩

  2. E. Rescorla; N. Modadugu (January 2012). Datagram Transport Layer Security Version 1.2. Internet Engineering Task Force. doi:10.17487/RFC6347. ISSN 2070-1721. RFC 6347. Obsolete. Obsoleted by RFC 9147. Updated by RFC 7507, 7905, 8996 and 9146. Obsoletes RFC 4347. https://datatracker.ietf.org/doc/html/rfc6347 ↩

  3. E. Rescorla; H. Tschofenig; N. Modadugu (April 2022). The Datagram Transport Layer Security (DTLS) Protocol Version 1.3. Internet Engineering Task Force TLS workgroup. doi:10.17487/RFC9147. RFC 9147. Proposed Standard. Obsoletes RFC 6347. https://datatracker.ietf.org/doc/html/rfc9147 ↩

  4. Titz, Olaf (2001-04-23). "Why TCP Over TCP Is A Bad Idea". Archived from the original on 2023-03-10. Retrieved 2015-10-17.{{cite web}}: CS1 maint: bot: original URL status unknown (link) https://web.archive.org/web/20230310043036/http://sites.inka.de/bigred/devel/tcp-tcp.html ↩

  5. Honda, Osamu; Ohsaki, Hiroyuki; Imase, Makoto; Ishizuka, Mika; Murayama, Junichi (October 2005). "Understanding TCP over TCP: effects of TCP tunneling on end-to-end throughput and latency". In Atiquzzaman, Mohammed; Balandin, Sergey I (eds.). Performance, Quality of Service, and Control of Next-Generation Communication and Sensor Networks III. Vol. 6011. Bibcode:2005SPIE.6011..138H. CiteSeerX 10.1.1.78.5815. doi:10.1117/12.630496. S2CID 8945952. /wiki/Bibcode_(identifier) ↩

  6. T. Phelan (May 2008). Datagram Transport Layer Security (DTLS) over the Datagram Congestion Control Protocol (DCCP). Network Working Group. doi:10.17487/RFC5238. RFC 5238. Informational. Updated by RFC 8996. https://datatracker.ietf.org/doc/html/rfc5238 ↩

  7. P. Calhoun; M. Montemurro; D. Stanley, eds. (March 2009). Control And Provisioning of Wireless Access Points (CAPWAP) Protocol Specification. Network Working Group. doi:10.17487/RFC5415. RFC 5415. Proposed Standard. Updated by RFC 8553 and 8996. https://datatracker.ietf.org/doc/html/rfc5415 ↩

  8. D. McGrew; E. Rescorla (May 2010). Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP). Internet Engineering Task Force. doi:10.17487/RFC5764. ISSN 2070-1721. RFC 5764. Proposed Standard. Updated by RFC 7983 and 9443. https://datatracker.ietf.org/doc/html/rfc5764 ↩

  9. Peck, M.; Igoe, K. (2012-09-25). "Suite B Profile for Datagram Transport Layer Security / Secure Real-time Transport Protocol (DTLS-SRTP)". IETF. https://tools.ietf.org/html/draft-peck-suiteb-dtls-srtp-02 ↩

  10. M. Tuexen; R. Seggelmann; E. Rescorla (January 2011). Datagram Transport Layer Security (DTLS) for Stream Control Transmission Protocol (SCTP). Internet Engineering Task Force (IETF). doi:10.17487/RFC6083. ISSN 2070-1721. RFC 6083. Proposed Standard. Updated by RFC 8996. https://datatracker.ietf.org/doc/html/rfc6083 ↩

  11. E. Rescorla; H. Tschofenig; N. Modadugu (April 2022). The Datagram Transport Layer Security (DTLS) Protocol Version 1.3. Internet Engineering Task Force TLS workgroup. doi:10.17487/RFC9147. RFC 9147. Proposed Standard. Obsoletes RFC 6347. https://datatracker.ietf.org/doc/html/rfc9147 ↩

  12. E. Rescorla; N. Modadugu (January 2012). Datagram Transport Layer Security Version 1.2. Internet Engineering Task Force. doi:10.17487/RFC6347. ISSN 2070-1721. RFC 6347. Obsolete. Obsoleted by RFC 9147. Updated by RFC 7507, 7905, 8996 and 9146. Obsoletes RFC 4347. https://datatracker.ietf.org/doc/html/rfc6347 ↩

  13. "The Datagram Transport Layer Security (DTLS) Protocol Version 1.3". https://datatracker.ietf.org/doc/draft-ietf-tls-dtls13/ ↩

  14. E. Rescorla; N. Modadugu (April 2006). Datagram Transport Layer Security. Network Working Group. doi:10.17487/RFC4347. RFC 4347. Obsolete. Obsoleted by RFC 6347. Updated by RFC 5746 and 7507. https://datatracker.ietf.org/doc/html/rfc4347 ↩

  15. E. Rescorla; N. Modadugu (January 2012). Datagram Transport Layer Security Version 1.2. Internet Engineering Task Force. doi:10.17487/RFC6347. ISSN 2070-1721. RFC 6347. Obsolete. Obsoleted by RFC 9147. Updated by RFC 7507, 7905, 8996 and 9146. Obsoletes RFC 4347. https://datatracker.ietf.org/doc/html/rfc6347 ↩

  16. E. Rescorla; H. Tschofenig; N. Modadugu (April 2022). The Datagram Transport Layer Security (DTLS) Protocol Version 1.3. Internet Engineering Task Force TLS workgroup. doi:10.17487/RFC9147. RFC 9147. Proposed Standard. Obsoletes RFC 6347. https://datatracker.ietf.org/doc/html/rfc9147 ↩

  17. "LibreSSL 3.3.2 Release Notes". The OpenBSD Project. 2021-05-01. Retrieved 2021-06-13. https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.3.2-relnotes.txt ↩

  18. Julien Kauffmann. "libsystools: A TLS/DTLS open source library for Windows/Linux using OpenSSL". SourceForge. http://sourceforge.net/projects/libsystools/ ↩

  19. "mbed TLS 2.0.0 released". ARM. 2015-07-13. Retrieved 2015-08-25. https://tls.mbed.org/tech-updates/releases/mbedtls-2.0.0-released ↩

  20. "mbed TLS 2.0.0 released". ARM. 2015-07-13. Retrieved 2015-08-25. https://tls.mbed.org/tech-updates/releases/mbedtls-2.0.0-released ↩

  21. "NSS 3.14 release notes". Mozilla Developer Network. Mozilla. Archived from the original on 2013-01-17. Retrieved 2012-10-27. https://web.archive.org/web/20130117130029/https://developer.mozilla.org/en-US/docs/NSS/NSS_3.14_release_notes ↩

  22. "NSS 3.16.2 release notes". Mozilla Developer Network. Mozilla. 2014-06-30. Archived from the original on 2021-12-07. Retrieved 2014-06-30. https://web.archive.org/web/20211207015257/https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.16.2_release_notes ↩

  23. "As of version 1.0.2". The OpenSSL Project. 2015-01-22. Archived from the original on 2014-09-04. Retrieved 2015-01-26. https://web.archive.org/web/20140904045720/http://www.openssl.org/news/openssl-1.0.2-notes.html ↩

  24. Ray Brown. "pydtls - Datagram Transport Layer Security for Python". GitHub. https://github.com/rbit/pydtls ↩

  25. Ray Brown. "DTLS for Python". Python Software Foundation. https://pypi.python.org/pypi/Dtls ↩

  26. Ray Brown/Mobius Software LTD. "pydtls - Datagram Transport Layer Security for Python". GitHub. https://github.com/mobius-software-ltd/pyton3-dtls ↩

  27. Ray Brown/Mobius Software LTD. "DTLS for Python3 Based on PyDTLS". Python Software Foundation. https://pypi.python.org/pypi/python3-dtls ↩

  28. "An update is available that adds support for DTLS in Windows 7 SP1 and Windows Server 2008 R2 SP1". Microsoft. Retrieved 13 November 2012. http://support.microsoft.com/kb/2574819/en-us ↩

  29. "An update is available that adds support for DTLS in Windows 7 SP1 and Windows Server 2008 R2 SP1". Microsoft. Retrieved 13 November 2012. http://support.microsoft.com/kb/2574819/en-us ↩

  30. Justinha. "TLS (Schannel SSP) changes in Windows 10 and Windows Server 2016". docs.microsoft.com. Retrieved 2017-09-01. https://docs.microsoft.com/en-us/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server#dtls-12 ↩

  31. "Technical Note TN2287: iOS 5 and TLS 1.2 Interoperability Issues". iOS Developer Library. Apple Inc. Retrieved 2012-05-03. https://developer.apple.com/library/ios/technotes/tn2287/ ↩

  32. Olaf Bergmann. "tinydtls". Eclipse Foundation. https://projects.eclipse.org/projects/iot.tinydtls ↩

  33. Peter Waher. "Waher.Security.DTLS". Waher Data AB. https://www.nuget.org/packages/Waher.Security.DTLS/ ↩

  34. "wolfSSL Embedded SSL/TLS Library". https://www.wolfssl.com/products/wolfssl/ ↩

  35. Dmitriy Tsvettsikh. "Secure UDP communications using DTLS in pure js". GitHub. https://github.com/nodertc/dtls ↩

  36. Dmitriy Tsvettsikh. "DTLS in pure js". npm. https://www.npmjs.com/package/@nodertc/dtls ↩

  37. Mobius Software LTD. "Non blocking Java DTLS Implementation based on BouncyCastle and Netty". Mobius Software LTD. https://github.com/mobius-software-ltd/java-dtls ↩

  38. Sean DuBois. "pion/dtls: DTLS 1.2 Server/Client implementation for Go". GitHub. https://github.com/pion/dtls ↩

  39. "californium/scandium: DTLS 1.2 Server/Client implementation for java and coap. Includes connection id extension". Eclipse Foundation. https://github.com/eclipse/californium ↩

  40. SNF4J.ORG. "Simple Network Framework for Java (SNF4J)". GitHub.{{cite web}}: CS1 maint: numeric names: authors list (link) https://github.com/snf4j/snf4j ↩

  41. "AnyConnect FAQ: tunnels, reconnect behavior, and the inactivity timer". Cisco. Retrieved 26 February 2017. http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116312-qanda-anyconnect-00.html ↩

  42. "OpenConnect". OpenConnect. Retrieved 26 February 2017. https://www.infradead.org/openconnect/ ↩

  43. "Cisco InterCloud Architectural Overview" (PDF). Cisco Systems. http://www.cisco.com/c/en/us/td/docs/solutions/Hybrid_Cloud/Intercloud/Intercloud_Fabric/Intercloud_Fabric_2.pdf ↩

  44. "Cato Networks Cipher Suites Used by the Cato Socket and SDP Client". https://support.catonetworks.com/hc/en-us/articles/115005910469-Cipher-Suites-Used-by-the-Cato-Socket-and-SDP-Client ↩

  45. "Cato Networks Routing Traffic to an Off-Cloud Link". https://support.catonetworks.com/hc/en-us/articles/4413265642257-Routing-Traffic-to-an-Off-Cloud-Link ↩

  46. "ZScaler ZTNA 2.0 Tunnel". ZScaler. https://help.zscaler.com/z-app/about-z-tunnel-1.0-z-tunnel-2.0 ↩

  47. "f5 Datagram Transport Layer Security (DTLS)". f5 Networks. https://f5.com/glossary/datagram-transport-layer-security-dtls ↩

  48. "Using DTLS to improve SSL VPN performance". Fortinet. 25 February 2016. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-DTLS-to-improve-SSL-VPN-performance/ta-p/193881 ↩

  49. "array.c from OpenConnect". 23 May 2022. https://gitlab.com/openconnect/openconnect/-/blob/653ad5585af44a2b8fa7d5946645ccb0e3f6ab60/array.c#L740-749 ↩

  50. "Configuring a DTLS Virtual Server". Citrix Systems. http://docs.citrix.com/en-us/netscaler/11/traffic-management/ssl/config-ssloffloading/config-dtls-vserver.html ↩

  51. "WebRTC Interop Notes". Archived from the original on 2013-05-11. https://web.archive.org/web/20130511043959/https://sites.google.com/site/webrtc/interop ↩

  52. "Firefox 86.0, See All New Features, Updates and Fixes". Mozilla. 2021-02-23. Archived from the original on 2021-02-22. Retrieved 2021-02-23. From Firefox 86 onward, DTLS 1.0 is no longer supported for establishing WebRTC's PeerConnections. All WebRTC services need to support DTLS 1.2 from now on as the minimum version. https://www.mozilla.org/en-US/firefox/86.0/releasenotes/ ↩

  53. "Plaintext-Recovery Attacks Against Datagram TLS" (PDF). http://www.isg.rhul.ac.uk/~kp/dtls.pdf ↩