Jump to content

Datagram Transport Layer Security

From Wikipedia, the free encyclopedia
(Redirected fromDTLS)
Not to be confused withTDLS.

Datagram Transport Layer Security(DTLS) is acommunications protocolprovidingsecuritytodatagram-based applications by allowing them to communicate in a way designed[1][2][3]to preventeavesdropping,tampering,ormessage forgery.The DTLS protocol is based on thestream-orientedTransport Layer Security(TLS) protocol and is intended to provide similar security guarantees. The DTLS protocol datagram preserves the semantics of the underlying transport—the application does not suffer from the delays associated with stream protocols, but because it usesUDPorSCTP,the application has to deal withpacket reordering,loss of datagram and data larger than the size of a datagramnetwork packet.Because DTLS uses UDP or SCTP rather than TCP, it avoids the "TCP meltdown problem",[4][5]when being used to create a VPN tunnel.

Definition

[edit]

The following documents define DTLS:

  • RFC5238from May 2008[6]for use withDatagram Congestion Control Protocol(DCCP)
  • RFC5415from March 2009[7]for use withControl And Provisioning of Wireless Access Points(CAPWAP)
  • RFC5764from May 2010[8]for use withSecure Real-time Transport Protocol(SRTP) subsequently calledDTLS-SRTPin a draft withSecure Real-Time Transport Control Protocol(SRTCP)[9]
  • RFC6083from January 2011[10]for use withStream Control Transmission Protocol(SCTP) encapsulation
  • RFC9147from April 2022[3]for use withUser Datagram Protocol(UDP)

DTLS 1.0 is based on TLS 1.1, DTLS 1.2 is based on TLS 1.2, and DTLS 1.3 is based on TLS 1.3. There is no DTLS 1.1 because this version-number was skipped in order to harmonize version numbers with TLS.[2]Like previous DTLS versions, DTLS 1.3 is intended to provide "equivalent security guarantees [to TLS 1.3] with the exception of order protection/non-replayability".[11]

Implementations

[edit]

Libraries

[edit]
Main article:Comparison of TLS implementations § Protocol support
Library support for DTLS
Implementation DTLS 1.0[1] DTLS 1.2[2] DTLS 1.3[3]
Botan Yes Yes
cryptlib No No
GnuTLS Yes Yes
Java Secure Socket Extension Yes Yes
LibreSSL Yes Yes[12]
libsystools[13] Yes No
MatrixSSL Yes Yes
mbed TLS(previously PolarSSL) Yes[14] Yes[14]
Network Security Services Yes[15] Yes[16]
OpenSSL Yes Yes[17]
PyDTLS[18][19] Yes Yes
Python3-dtls[20][21] Yes Yes
RSA BSAFE No No
s2n No No
Schannel XP/2003, Vista/2008 No No
Schannel 7/2008R2, 8/2012, 8.1/2012R2, 10 Yes[22] No[22]
Schannel 10 (1607), 2016 Yes Yes[23]
Secure Transport OS X 10.2–10.7 / iOS 1–4 No No
Secure Transport OS X 10.8–10.10 / iOS 5–8 Yes[24] No
SharkSSL No No
tinydtls[25] No Yes
Waher.Security.DTLS[26] No Yes
wolfSSL(previously CyaSSL)[27] Yes Yes Yes
@nodertc/dtls[28][29] No Yes
java-dtls[30] Yes Yes
pion/dtls[31](Go) No Yes
californium/scandium[32](Java) No Yes
SNF4J[33](Java) Yes Yes
Implementation DTLS 1.0 DTLS 1.2 DTLS 1.3

Applications

[edit]

Vulnerabilities

[edit]

In February 2013 two researchers from Royal Holloway, University of London discovered a timing attack[44]which allowed them to recover (parts of the) plaintext from a DTLS connection using the OpenSSL or GnuTLS implementation of DTLS whenCipher Block Chainingmode encryption was used.

See also

[edit]

References

[edit]
  1. ^abE. Rescorla; N. Modadugu (April 2006).Datagram Transport Layer Security.Network Working Group.doi:10.17487/RFC4347.RFC4347.Obsolete.Obsoleted byRFC6347.Updated byRFC5746and7507.
  2. ^abcE. Rescorla; N. Modadugu (January 2012).Datagram Transport Layer Security Version 1.2.Internet Engineering Task Force(IETF).doi:10.17487/RFC6347.ISSN2070-1721.RFC6347.Obsolete.Obsoleted byRFC9147.Updated byRFC7507,7905,8996and9146.ObsoletesRFC4347.
  3. ^abcE. Rescorla; H. Tschofenig; N. Modadugu (April 2022).The Datagram Transport Layer Security (DTLS) Protocol Version 1.3.IETFTLS workgroup.doi:10.17487/RFC9147.RFC9147.Proposed Standard.ObsoletesRFC6347
  4. ^Titz, Olaf (2001-04-23)."Why TCP Over TCP Is A Bad Idea".Archived from the original on 2023-03-10.Retrieved2015-10-17.{{cite web}}:CS1 maint: bot: original URL status unknown (link)
  5. ^Honda, Osamu; Ohsaki, Hiroyuki; Imase, Makoto; Ishizuka, Mika; Murayama, Junichi (October 2005). "Understanding TCP over TCP: effects of TCP tunneling on end-to-end throughput and latency". In Atiquzzaman, Mohammed; Balandin, Sergey I (eds.).Performance, Quality of Service, and Control of Next-Generation Communication and Sensor Networks III.Vol. 6011.Bibcode:2005SPIE.6011..138H.CiteSeerX10.1.1.78.5815.doi:10.1117/12.630496.S2CID8945952.
  6. ^T. Phelan (May 2008).Datagram Transport Layer Security (DTLS) over the Datagram Congestion Control Protocol (DCCP).Network Working Group.doi:10.17487/RFC5238.RFC5238.Informational.Updated byRFC8996.
  7. ^P. Calhoun; M. Montemurro; D. Stanley, eds. (March 2009).Control And Provisioning of Wireless Access Points (CAPWAP) Protocol Specification.Network Working Group.doi:10.17487/RFC5415.RFC5415.Proposed Standard.Updated byRFC8553and8996.
  8. ^D. McGrew; E. Rescorla (May 2010).Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP).Internet Engineering Task Force.doi:10.17487/RFC5764.ISSN2070-1721.RFC5764.Proposed Standard.Updated byRFC7983and9443.
  9. ^Peck, M.; Igoe, K. (2012-09-25)."Suite B Profile for Datagram Transport Layer Security / Secure Real-time Transport Protocol (DTLS-SRTP)".IETF.
  10. ^M. Tuexen; R. Seggelmann; E. Rescorla (January 2011).Datagram Transport Layer Security (DTLS) for Stream Control Transmission Protocol (SCTP).Internet Engineering Task Force(IETF).doi:10.17487/RFC6083.ISSN2070-1721.RFC6083.Proposed Standard.Updated byRFC8996.
  11. ^"The Datagram Transport Layer Security (DTLS) Protocol Version 1.3".
  12. ^"LibreSSL 3.3.2 Release Notes".The OpenBSD Project. 2021-05-01.Retrieved2021-06-13.
  13. ^Julien Kauffmann."libsystools: A TLS/DTLS open source library for Windows/Linux using OpenSSL".SourceForge.
  14. ^ab"mbed TLS 2.0.0 released".ARM. 2015-07-13.Retrieved2015-08-25.
  15. ^"NSS 3.14 release notes".Mozilla Developer Network.Mozilla. Archived fromthe originalon 2013-01-17.Retrieved2012-10-27.
  16. ^"NSS 3.16.2 release notes".Mozilla Developer Network.Mozilla. 2014-06-30. Archived fromthe originalon 2021-12-07.Retrieved2014-06-30.
  17. ^"As of version 1.0.2".The OpenSSL Project.The OpenSSL Project. 2015-01-22. Archived fromthe originalon 2014-09-04.Retrieved2015-01-26.
  18. ^Ray Brown."pydtls - Datagram Transport Layer Security for Python".GitHub.
  19. ^Ray Brown."DTLS for Python".Python Software Foundation.
  20. ^Ray Brown/Mobius Software LTD."pydtls - Datagram Transport Layer Security for Python".GitHub.
  21. ^Ray Brown/Mobius Software LTD."DTLS for Python3 Based on PyDTLS".Python Software Foundation.
  22. ^ab"An update is available that adds support for DTLS in Windows 7 SP1 and Windows Server 2008 R2 SP1".Microsoft.Retrieved13 November2012.
  23. ^Justinha."TLS (Schannel SSP) changes in Windows 10 and Windows Server 2016".docs.microsoft.Retrieved2017-09-01.
  24. ^"Technical Note TN2287: iOS 5 and TLS 1.2 Interoperability Issues".iOS Developer Library.Apple Inc.Retrieved2012-05-03.
  25. ^Olaf Bergmann."tinydtls".Eclipse Foundation.
  26. ^Peter Waher."Waher.Security.DTLS".Waher Data AB.
  27. ^"wolfSSL Embedded SSL/TLS Library".
  28. ^Dmitriy Tsvettsikh."Secure UDP communications using DTLS in pure js".GitHub.
  29. ^Dmitriy Tsvettsikh."DTLS in pure js".npm.
  30. ^Mobius Software LTD."Non blocking Java DTLS Implementation based on BouncyCastle and Netty".Mobius Software LTD.
  31. ^Sean DuBois."pion/dtls: DTLS 1.2 Server/Client implementation for Go".GitHub.
  32. ^"californium/scandium: DTLS 1.2 Server/Client implementation for java and coap. Includes connection id extension".Eclipse Foundation.
  33. ^SNF4J.ORG."Simple Network Framework for Java (SNF4J)".GitHub.{{cite web}}:CS1 maint: numeric names: authors list (link)
  34. ^"AnyConnect FAQ: tunnels, reconnect behavior, and the inactivity timer".Cisco.Retrieved26 February2017.
  35. ^"OpenConnect".OpenConnect.Retrieved26 February2017.
  36. ^"Cisco InterCloud Architectural Overview"(PDF).Cisco Systems.
  37. ^"ZScaler ZTNA 2.0 Tunnel".ZScaler.
  38. ^"f5 Datagram Transport Layer Security (DTLS)".f5 Networks.
  39. ^"Using DTLS to improve SSL VPN performance".Fortinet.25 February 2016.
  40. ^"array.c from OpenConnect".23 May 2022.
  41. ^"Configuring a DTLS Virtual Server".Citrix Systems.
  42. ^"WebRTC Interop Notes".Archived fromthe originalon 2013-05-11.
  43. ^"Firefox 86.0, See All New Features, Updates and Fixes".Mozilla.2021-02-23.Archivedfrom the original on 2021-02-22.Retrieved2021-02-23.From Firefox 86 onward, DTLS 1.0 is no longer supported for establishing WebRTC's PeerConnections. All WebRTC services need to support DTLS 1.2 from now on as the minimum version.
  44. ^"Plaintext-Recovery Attacks Against Datagram TLS"(PDF).
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Datagram_Transport_Layer_Security&oldid=1235503571"