Subject: [Tsvwg] Looking for feedback on DTLS

From: Eric Rescorla <[email-masked]>
Date: Wed, 11 Aug 2004 11:22:06 -0700

As we all know, TLS is popular but is only compatible with reliable
transports. Unfortunately, a number of important protocols (SIP in
particular) run over datagram transport and therefore cannot use TLS. In
response, Nagendra Modadugu and I have designed a variant of TLS which
we call Datagram TLS (DTLS).  DTLS consists of only the minimal changes
required to TLS to make it operate on datagram transport.

We've submitted DTLS as an I-D which you can find at:
draft-rescorla-dtls-01.txt

You can also read our paper on DTLS from ISOC NDSS at:
http://crypto.stanford.edu/~nagendra/papers/dtls.pdf

We've already gotten some useful comments from PMTUD people about
handling PMTU but any comments TSV people have on the protocol would be
appreciated.

Best,
-Ekr

_______________________________________________
tsvwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tsvwg

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 11 Aug 2004 12:23:39 -0700

Eric Rescorla <[email-masked]> writes:
> particular) run over datagram transport and therefore cannot use TLS.

This was bad writing on my part: 
Obviously, SIP *can* use TCP and when it's operating in TCP mode
it can use TLS. However, SIP can also operate in UDP mode and
in those situations one obviously cannot use TLS. In my conversations
with SIP people, it's been my understanding that there are situations
in which they would like to be able to UDP, but that that comes
into conflict with the desire to use TLS. DTLS is designed to
address that need. If I've misunderstood and that's not the situation,
I trust someone will correct me.

Sorry for the confusion.

-Ekr

---

From: Qiaobing Xie <[email-masked]>
Date: Thu, 12 Aug 2004 14:58:41 +0800

Eric,

Would DTLS also render support to the un-ordered and partial reliability SCTP data transfer?

regards,
-Qiaobing

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 12 Aug 2004 07:53:14 -0700

> reliability SCTP data transfer?

Yes.

That said, Michael Tuexen and Randall Stewart have both pointed out
to me that as SCTP provides better information/guarantees in some
cases, you could probably get away without some of the DTLS machinery,
but I'm not sure that that would be that useful an optimization
at the end of the day.

Cheers,
-Ekr

---

From: Michael Tuexen <[email-masked]>
Date: Thu, 19 Aug 2004 13:48:55 +0200

Dear Qiaobing, Dear Eric,

I think it is necessary to have a version of TLS which
- supports all SCTP features including PR-SCTP
- is implementable within the openssl library

The current method of TLS over SCTP does not support
'out of order delivery' and PR-SCTP. The other problem
is that it uses a TLS connection for each bidirectional
stream. This is difficult to implement in openssl, because
you do not have a socket per stream.

So I thought about a modified version of TLS and talked to
Eric at the last IETF. His suggestion was to simply use
DTLS. I'm just looking at that and trying to understand DTLS.
The first point is to figure out if it works and the second
is if there are some optimizations.

Eric, here is one question for you:

You increment the epoch field with each cipher state change.
So I assume that a receiver has a state describing the current
epoch, right? How are packets handled which are received with
an epoch less than the current one? Do you discard that packet
or do you have also the old state available to process it?

Best regards
Michael