Datagram Transport Layer Security
Communications protocol
- 2 min read
- 3 chapters
Related on Lably
Through Stream (computing)
Definition
The following documents define DTLS:
- RFC 5238 from May 2008 for use with Datagram Congestion Control Protocol (DCCP)
- RFC 5415 from March 2009 for use with Control And Provisioning of Wireless Access Points (CAPWAP)
- RFC 5764 from May 2010 for use with Secure Real-time Transport Protocol (SRTP) subsequently called DTLS-SRTP in a draft with Secure Real-Time Transport Control Protocol (SRTCP)
- RFC 6083 from January 2011 for use with Stream Control Transmission Protocol (SCTP) encapsulation
- RFC 6347 from January 2012 defining DTLS 1.2
- RFC 9147 from April 2022 defining DTLS 1.3
DTLS 1.0 is based on TLS 1.1, DTLS 1.2 is based on TLS 1.2, and DTLS 1.3 is based on TLS 1.3. There is no DTLS 1.1 because this version-number was skipped in order to harmonize version numbers with TLS. Like previous DTLS versions, DTLS 1.3 is intended to provide "equivalent security guarantees [to TLS 1.3] with the exception of order protection/non-replayability".
Sign in to keep reading
2 more chapters are free with a Lably account.
Implementations
Libraries
Applications
- Cisco AnyConnect VPN Client uses TLS and invented DTLS-based VPN.
- OpenConnect is an open source AnyConnect-compatible client and ocserv server that supports (D)TLS.
- Cisco InterCloud Fabric uses DTLS to form a tunnel between private and public/provider compute environments.
- Cato Networks utilizes DTLS v1.2 for the underlay tunnel used by both the Cato Socket and Cato ZTNA (formerly SDP) client when forming tunnels to the Cato POPs and when forming off-cloud tunnels between Cato sockets.
- ZScaler tunnel 2.0 for ZScaler Internet Access (ZIA) uses DTLS for tunneling. ZScaler Private Access (ZPA) does not support DTLS
- F5 Networks Edge VPN Client uses TLS and DTLS.
- Fortinet's SSL VPN and Array Networks SSL VPN also use DTLS for VPN tunneling.
- Citrix Systems NetScaler uses DTLS to secure UDP.
- Web browsers: Google Chrome, Opera and Firefox support DTLS-SRTP for WebRTC. Firefox 86 and onward does not support DTLS 1.0.
- Remote Desktop Protocol 8.0 and onwards.
Vulnerabilities
In February 2013 two researchers from Royal Holloway, University of London discovered a timing attack which allowed them to recover (parts of the) plaintext from a DTLS connection using the OpenSSL or GnuTLS implementation of DTLS when Cipher Block Chaining mode encryption was used.