Datagram Transport Layer Security

From Wikipedia, the free encyclopedia
(Redirected from DTLS)

Script error: No such module "Distinguish". Template:Short description Datagram Transport Layer Security (DTLS) is a communications protocol providing security to datagram-based applications by allowing them to communicate in a way designedTemplate:Ref RFCTemplate:Ref RFCTemplate:Ref RFC to prevent eavesdropping, tampering, or message forgery. The DTLS protocol is based on the stream-oriented Transport Layer Security (TLS) protocol and is intended to provide similar security guarantees. The DTLS protocol datagram preserves the semantics of the underlying transport—the application does not suffer from the delays associated with stream protocols, but because it uses User Datagram Protocol (UDP) or Stream Control Transmission Protocol (SCTP), the application has to deal with packet reordering, loss of datagram and data larger than the size of a datagram network packet. Because DTLS uses UDP or SCTP rather than TCP it avoids the TCP meltdown problem[1][2] when being used to create a VPN tunnel.

Definition

The following documents define DTLS:

DTLS 1.0 is based on TLS 1.1, DTLS 1.2 is based on TLS 1.2, and DTLS 1.3 is based on TLS 1.3. There is no DTLS 1.1 because this version-number was skipped in order to harmonize version numbers with TLS.Template:Ref RFC Like previous DTLS versions, DTLS 1.3 is intended to provide "equivalent security guarantees [to TLS 1.3] with the exception of order protection/non-replayability".[4]

Implementations

Libraries

Template:Main article

Page Module:Message box/ambox.css has no content.

Library support for DTLS
Implementation DTLS 1.0Template:Ref RFC DTLS 1.2Template:Ref RFC DTLS 1.3Template:Ref RFC
Botan Yes Yes
cryptlib No No
GnuTLS Yes Yes
Java Secure Socket Extension Yes Yes
LibreSSL Yes Yes[5]
libsystools[6] Yes No
MatrixSSL Yes Yes
mbed TLS (previously PolarSSL) Yes[7] Yes[7]
Network Security Services Yes[8] Yes[9]
OpenSSL Yes Yes[10]
PyDTLS[11][12] Yes Yes
Python3-dtls[13][14] Yes Yes
RSA BSAFE No No
s2n No No
Schannel XP/2003, Vista/2008 No No
Schannel 7/2008R2, 8/2012, 8.1/2012R2, 10 Yes[15] No[15]
Schannel 10 (1607), 2016 Yes Yes[16]
Secure Transport OS X 10.2–10.7 / iOS 1–4 No No
Secure Transport OS X 10.8–10.10 / iOS 5–8 Yes[17] No
SharkSSL No No
tinydtls [18] No Yes
Waher.Security.DTLS [19] No Yes
wolfSSL (previously CyaSSL)[20] Yes Yes Yes
@nodertc/dtls [21][22] No Yes
java-dtls[23] Yes Yes
pion/dtls[24] (Go) No Yes
californium/scandium[25] (Java) No Yes
SNF4J[26] (Java) Yes Yes
Implementation DTLS 1.0 DTLS 1.2 DTLS 1.3

Applications

  • Cisco AnyConnect VPN Client uses TLS and invented DTLS-based VPN.[27]
  • OpenConnect is an open source AnyConnect-compatible client and ocserv server that supports (D)TLS.[28]
  • Cisco InterCloud Fabric uses DTLS to form a tunnel between private and public/provider compute environments.[29]
  • Cato Networks utilizes DTLS v1.2 for the underlay tunnel used by both the Cato Socket and Cato ZTNA (formerly SDP) client when forming tunnels to the Cato POPs [30] and when forming off-cloud tunnels between Cato sockets.[31]
  • ZScaler tunnel 2.0 for ZScaler Internet Access (ZIA) uses DTLS for tunneling. ZScaler Private Access (ZPA) does not support DTLS [32]
  • F5 Networks Edge VPN Client uses TLS and DTLS.[33]
  • Fortinet's SSL VPN[34] and Array Networks SSL VPN[35] also use DTLS for VPN tunneling.
  • Citrix Systems NetScaler uses DTLS to secure UDP.[36]
  • Web browsers: Google Chrome, Opera and Firefox support DTLS-SRTP[37] for WebRTC. Firefox 86 and onward does not support DTLS 1.0.[38]
  • Remote Desktop Protocol 8.0 and onwards.

Vulnerabilities

In February 2013 two researchers from Royal Holloway, University of London discovered a timing attack[39] which allowed them to recover (parts of the) plaintext from a DTLS connection using the OpenSSL or GnuTLS implementation of DTLS when Cipher Block Chaining mode encryption was used.

See also

Lua error in mw.title.lua at line 404: bad argument #2 to 'title.new' (unrecognized namespace name 'Portal').

References

Page Template:Reflist/styles.css has no content.

  1. ^ Page Module:Citation/CS1/styles.css has no content.Titz, Olaf (2001-04-23). "Why TCP Over TCP Is A Bad Idea". Archived from the original on 2023-03-10. Retrieved 2015-10-17.{{cite web}}: CS1 maint: bot: original URL status unknown (link)
  2. ^ Page Module:Citation/CS1/styles.css has no content.Honda, Osamu; Ohsaki, Hiroyuki; Imase, Makoto; Ishizuka, Mika; Murayama, Junichi (October 2005). "Understanding TCP over TCP: effects of TCP tunneling on end-to-end throughput and latency". In Atiquzzaman, Mohammed; Balandin, Sergey I (eds.). Performance, Quality of Service, and Control of Next-Generation Communication and Sensor Networks III. Vol. 6011. Bibcode:2005SPIE.6011..138H. CiteSeerX 10.1.1.78.5815. doi:10.1117/12.630496. S2CID 8945952.
  3. ^ Page Module:Citation/CS1/styles.css has no content.Peck, M.; Igoe, K. (2012-09-25). "Suite B Profile for Datagram Transport Layer Security / Secure Real-time Transport Protocol (DTLS-SRTP)". IETF.
  4. ^ Page Module:Citation/CS1/styles.css has no content."The Datagram Transport Layer Security (DTLS) Protocol Version 1.3".
  5. ^ Page Module:Citation/CS1/styles.css has no content."LibreSSL 3.3.2 Release Notes". The OpenBSD Project. 2021-05-01. Retrieved 2021-06-13.
  6. ^ Page Module:Citation/CS1/styles.css has no content.Julien Kauffmann. "libsystools: A TLS/DTLS open source library for Windows/Linux using OpenSSL". SourceForge.
  7. ^ a b Page Module:Citation/CS1/styles.css has no content."mbed TLS 2.0.0 released". ARM. 2015-07-13. Retrieved 2015-08-25.
  8. ^ Page Module:Citation/CS1/styles.css has no content."NSS 3.14 release notes". Mozilla Developer Network. Mozilla. Archived from the original on 2013-01-17. Retrieved 2012-10-27.
  9. ^ Page Module:Citation/CS1/styles.css has no content."NSS 3.16.2 release notes". Mozilla Developer Network. Mozilla. 2014-06-30. Archived from the original on 2021-12-07. Retrieved 2014-06-30.
  10. ^ Page Module:Citation/CS1/styles.css has no content."As of version 1.0.2". The OpenSSL Project. 2015-01-22. Archived from the original on 2014-09-04. Retrieved 2015-01-26.
  11. ^ Page Module:Citation/CS1/styles.css has no content.Ray Brown. "pydtls - Datagram Transport Layer Security for Python". GitHub.
  12. ^ Page Module:Citation/CS1/styles.css has no content.Ray Brown. "DTLS for Python". Python Software Foundation.
  13. ^ Page Module:Citation/CS1/styles.css has no content.Ray Brown/Mobius Software LTD. "pydtls - Datagram Transport Layer Security for Python". GitHub.
  14. ^ Page Module:Citation/CS1/styles.css has no content.Ray Brown/Mobius Software LTD. "DTLS for Python3 Based on PyDTLS". Python Software Foundation.
  15. ^ a b Page Module:Citation/CS1/styles.css has no content."An update is available that adds support for DTLS in Windows 7 SP1 and Windows Server 2008 R2 SP1". Microsoft. Retrieved 13 November 2012.
  16. ^ Page Module:Citation/CS1/styles.css has no content.Justinha. "TLS (Schannel SSP) changes in Windows 10 and Windows Server 2016". docs.microsoft.com. Retrieved 2017-09-01.
  17. ^ Page Module:Citation/CS1/styles.css has no content."Technical Note TN2287: iOS 5 and TLS 1.2 Interoperability Issues". iOS Developer Library. Apple Inc. Retrieved 2012-05-03.
  18. ^ Page Module:Citation/CS1/styles.css has no content.Olaf Bergmann. "tinydtls". Eclipse Foundation.
  19. ^ Page Module:Citation/CS1/styles.css has no content.Peter Waher. "Waher.Security.DTLS". Waher Data AB.
  20. ^ Page Module:Citation/CS1/styles.css has no content."wolfSSL Embedded SSL/TLS Library".
  21. ^ Page Module:Citation/CS1/styles.css has no content.Dmitriy Tsvettsikh. "Secure UDP communications using DTLS in pure js". GitHub.
  22. ^ Page Module:Citation/CS1/styles.css has no content.Dmitriy Tsvettsikh. "DTLS in pure js". npm.
  23. ^ Page Module:Citation/CS1/styles.css has no content.Mobius Software LTD. "Non blocking Java DTLS Implementation based on BouncyCastle and Netty". Mobius Software LTD.
  24. ^ Page Module:Citation/CS1/styles.css has no content.Sean DuBois. "pion/dtls: DTLS 1.2 Server/Client implementation for Go". GitHub.
  25. ^ Page Module:Citation/CS1/styles.css has no content."californium/scandium: DTLS 1.2 Server/Client implementation for java and coap. Includes connection id extension". Eclipse Foundation.
  26. ^ Page Module:Citation/CS1/styles.css has no content.SNF4J.ORG. "Simple Network Framework for Java (SNF4J)". GitHub.{{cite web}}: CS1 maint: numeric names: authors list (link)
  27. ^ Page Module:Citation/CS1/styles.css has no content."AnyConnect FAQ: tunnels, reconnect behavior, and the inactivity timer". Cisco. Retrieved 26 February 2017.
  28. ^ Page Module:Citation/CS1/styles.css has no content."OpenConnect". OpenConnect. Retrieved 26 February 2017.
  29. ^ Page Module:Citation/CS1/styles.css has no content."Cisco InterCloud Architectural Overview" (PDF). Cisco Systems.
  30. ^ Page Module:Citation/CS1/styles.css has no content."Cato Networks Cipher Suites Used by the Cato Socket and SDP Client".
  31. ^ Page Module:Citation/CS1/styles.css has no content."Cato Networks Routing Traffic to an Off-Cloud Link".
  32. ^ Page Module:Citation/CS1/styles.css has no content."ZScaler ZTNA 2.0 Tunnel". ZScaler.
  33. ^ Page Module:Citation/CS1/styles.css has no content."f5 Datagram Transport Layer Security (DTLS)". f5 Networks.
  34. ^ Page Module:Citation/CS1/styles.css has no content."Using DTLS to improve SSL VPN performance". Fortinet. 25 February 2016.
  35. ^ Page Module:Citation/CS1/styles.css has no content."array.c from OpenConnect". 23 May 2022.
  36. ^ Page Module:Citation/CS1/styles.css has no content."Configuring a DTLS Virtual Server". Citrix Systems.
  37. ^ Page Module:Citation/CS1/styles.css has no content."WebRTC Interop Notes". Archived from the original on 2013-05-11.
  38. ^ Page Module:Citation/CS1/styles.css has no content."Firefox 86.0, See All New Features, Updates and Fixes". Mozilla. 2021-02-23. Archived from the original on 2021-02-22. Retrieved 2021-02-23. From Firefox 86 onward, DTLS 1.0 is no longer supported for establishing WebRTC's PeerConnections. All WebRTC services need to support DTLS 1.2 from now on as the minimum version.
  39. ^ Page Module:Citation/CS1/styles.css has no content."Plaintext-Recovery Attacks Against Datagram TLS" (PDF). Archived from the original (PDF) on 2012-01-18. Retrieved 2013-11-25.

Lua error in package.lua at line 80: module 'Module:Navbox/configuration' not found. Template:VPN

Retrieved from "https://cosmopedia.co/index.php?title=Datagram_Transport_Layer_Security&oldid=836439"