Introducing DTLS

The OpenSSL Library has supported Transport Layer Security (TLS) since its early days. It effectively turns network connections into secure network connections. With TLS any device can communicate to any other device without fear of the message being intercepted or altered along the way. TLS is built into modern network systems so that anyone can set up a reliably secure line to anyone else.

TLS was designed so that data is guaranteed to arrive in the same order that it’s sent. When everything works according to plan, it’s an efficient way to send information. A flaky connection, however, can cause delays as the stream of information must be delayed so that missing information can be retransmitted.

‍

To make an analogy to every-day circumstances, think about reading a long number, such as a bank account, over the phone. If all goes well, you say the number and the other person understands it. But if there’s a sudden loud noise, a bit of static or some other distraction, the other person might need you to repeat the number. In any case, the person at the other end usually verifies the number to be sure they got each number in the right order. 

Some systems, however, can’t wait for this sort of back and forth to get a message through. Datagrams provide a solution. Instead of a stream of information, a datagram is a self-contained message that includes enough information in its header to get the payload to its destination. Think of sending mail. The envelope contains all the information the postal service needs to get the message to the recipient. Like a piece of mail, a datagram arrives independent of other messages.

To take one example, realtime multiplayer games use datagrams because delays ruin the experience. Updates that arrive too late introduce noticeable lag for the players. For that reason games are designed so that a missing bit of data doesn’t stop the game in its tracks. Players might not even notice network problems because the game fills in missing information with educated guesses. There’s no need to go back and ask for data that was dropped along the way because the game has already moved on.

Datagram TLS (DTLS) provides secure communication for systems that use datagrams. To quote from the DTLS 1.3 specification:

The basic design philosophy of DTLS is to construct "TLS over datagram transport". Datagram transport neither requires nor provides reliable or in-order delivery of data. The DTLS protocol preserves this property for application data. Applications such as media streaming, Internet telephony, and online gaming use datagram transport for communication due to the delay-sensitive nature of transported data. The behavior of such applications is unchanged when the DTLS protocol is used to secure communication, since the DTLS protocol does not compensate for lost or reordered data traffic.

Video calls have similar characteristics to video games. If you are on a call and one person has a slow connection, you might notice their video get choppy or switch to lower resolution for a bit. That’s a lot better than for them to freeze altogether. Of course you don’t want outsiders to watch your calls, which is why online meeting systems often use DTLS.

DTLS isn’t the only secure protocol built to use datagram networking protocols. A more recent entry is QUIC which was initially designed by Google in 2013. While QUIC uses parts of the TLS protocol under the hood, DTLS matches TLS as much as possible. It maximizes reuse, which is especially useful for hardware, and updates to the TLS protocol can be incorporated into DTLS.

Next time, how the OpenSSL community worked to get DTLS 1.3 into the 4.1 release.

Photo by Getty Images on Unsplash.

‍