DTLS

DTLS, or Datagram Transport Layer Security, is a security protocol that provides communications privacy and data integrity for datagram protocols. It is based on TLS but optimized for unreliable, unordered transport such as UDP, making it suitable for applications like VoIP, streaming, and certain DNS and WebRTC scenarios.

DTLS preserves most TLS security goals: mutual authentication (via certificates or pre-shared keys), confidentiality using symmetric encryption, and integrity via MACs or AEAD. It achieves this over UDP by employing a TLS-like handshake with a cookie exchange to prevent denial-of-service attacks. To cope with datagram characteristics, DTLS adds fragmentation of records, sequencing with per-record sequence numbers, and mechanisms for retransmission and reassembly when packets are lost or arrive out of order.

DTLS has two main standardized versions. DTLS 1.0 defined in RFC 4347 and DTLS 1.2 defined in RFC 6347. It uses the same cipher suites as TLS and can operate with certificates or PSK. Implementations are available in major TLS libraries and enable secure communication for UDP-based protocols, VPNs, and applications such as WebRTC's DTLS-SRTP.

Security considerations: like TLS, DTLS is vulnerable if misconfigured; it requires careful handling of renegotiation and session resumption. Effective DTLS deployments rely on correct certificate management, proper cipher suite selection, and timely patching of libraries.