Datagram Transport Layer Security

Not to be confused with TDLS.

In information technology, the Datagram Transport Layer Security (DTLS) protocol provides communications privacy for datagram protocols. DTLS allows datagram-based applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery. The DTLS protocol is based on the stream-oriented Transport Layer Security (TLS) protocol and is intended to provide similar security guarantees. The datagram semantics of the underlying transport are preserved by the DTLS protocol — the application will not suffer from the delays associated with stream protocols, but will have to deal with packet reordering, loss of datagram and data larger than a datagram network packet size.

Definition

The following documents define DTLS:

• RFC 6347 for use with User Datagram Protocol (UDP),
• RFC 5238 for use with Datagram Congestion Control Protocol (DCCP),
• RFC 6083 for use with Stream Control Transmission Protocol (SCTP) encapsulation,
• RFC 5764 for use with Secure Real-time Transport Protocol (SRTP) subsequently called DTLS-SRTP in a draft with Secure Real-Time Transport Control Protocol (SRTCP).

DTLS 1.0 is based on TLS 1.1, and DTLS 1.2 is based on TLS 1.2.

TLS basis of DTLS

Version	DTLS 1.0	DTLS 1.2
Based on	TLS 1.1	TLS 1.2

Implementations

Libraries

Main article: Comparison of TLS implementations § Protocol support

Library support for DTLS

Implementation	DTLS 1.0	DTLS 1.2
Botan	Yes	Yes
cryptlib	No	No
GnuTLS	Yes	Yes
Java Secure Socket Extension	No	No
LibreSSL	Yes	No
libsystools	Yes	No
MatrixSSL	Yes	Yes
mbed TLS (previously PolarSSL)	Beta	Beta
Network Security Services	Yes	Yes
OpenSSL	Yes	Yes
Python	Yes	No
RSA BSAFE	No	No
SChannel XP/2003, Vista/2008	No	No
SChannel 7/2008R2, 8/2012, 8.1/2012R2, 10 Technical Preview	Yes	Yes
Secure Transport OS X 10.2-10.7 / iOS 1-4	No	No
Secure Transport OS X 10.8-10.10 / iOS 5-8	Yes	No
SharkSSL	No	No
wolfSSL (previously CyaSSL)	Yes	Yes
Implementation	DTLS 1.0	DTLS 1.2

Applications

• Cisco AnyConnect VPN Client uses TLS and DTLS, as does the AnyConnect-compatible open-source OpenConnect client
• f5 Networks Edge VPN Client uses TLS and DTLS
• Web browsers: Google Chrome, Opera and Firefox support DTLS-SRTP for WebRTC

Vulnerabilities

In February 2013 two researchers from Royal Holloway, University of London discovered an attack which allowed them to recover plaintext from a DTLS connection when Cipher Block Chaining mode encryption was used.

See also

• ZRTP
• Reliable User Datagram Protocol
• QUIC

External links

• "Transport Layer Security (tls) - Charter". IETF. 
• Modadugu, Nagendra; Rescorla, Eric (2003-11-21). "The Design and Implementation of Datagram TLS". Stanford Crypto Group. Retrieved 2013-03-17. 
• AlFardan, Nadhem J.; Paterson, Kenneth G. "Plaintext-Recovery Attacks Against Datagram TLS". Retrieved 2013-11-25. 
• Gibson, Steve; Laporte, Leo (2012-11-28). "Datagram Transport Layer Security". Security Now 380. Retrieved 2013-03-17.  Skip to 1:07:14.
• Robin Seggelmann's Sample Code: echo, character generator, and discard client/servers.

This article is based on material taken from the Free On-line Dictionary of Computing prior to 1 November 2008 and incorporated under the "relicensing" terms of the GFDL, version 1.3 or later.