The difference between DTLS and TLS

Question

• What is the functional difference between TLS and DTLS?
• How is application flow / negotiation different when using TLS and DTLS?

Answer 1

In principle, DTLS should build TLS over a datagram (UDP, DCCP, etc.).

DTLS is intentionally similar to TLS, except that DTLS must solve two problems: packet loss and reordering. DTLS implements

• packet relay
• handshake
• playback detection.

See RFC 6347 for details.

Answer 2

DTLS is an implementation of TLS over UDP (datagram protocol). on Wikipedia, TLS uses TCP, and DTLS uses UDP, so all the classic differences apply. UDP communications exist as packet flows without ordering, delivery reliability, or flow control. Applications using datagram protocols should ensure that they can deal with these problems domestically.

https://en.wikipedia.org/wiki/Transport_Layer_Security#Applications_and_adoption

http://www.diffen.com/difference/TCP_vs_UDP

Answer 3

One of the differences is that due to the excess of UDP, stream ciphers are not allowed:

4.1.2.2. Zero or standard stream cipher

The DTLS NULL cipher works exactly the same as the TLS 1.2 NULL cipher.

The only stream cipher described in TLS 1.2 is RC4, which cannot be accessed randomly. RC4 MUST NOT be used with DTLS.

Answer 4

There are key differences between DTLS and Transport Layer Security Protocol (TLS), which an application programmer needs to know that other answers that are missing / implied do not exist!

The DTLS protocol provides communications privacy for datagram protocols. Contrary to the existing highest ratings of responses at the time of writing (archive) , DTLS is not an implementation of TLS over UDP (or datagram protocols in general). It includes the implementation of a very TLS-like handshake, modified to work on datagram protocols. The implementation really solves the problems of reordering and packet loss, but only for packets used to establish DTLS communications (and select a cipher). In other words, the “flights” that deliver these packets are delivered reliably. However, DTLS packets containing the payload (application data) deliver their payload no more reliably than DTLS packets (usually UDP) that encapsulate them.

In addition, although the DTLS protocol (v1.2) is derived from the TLS protocol (v1.2) and claims to provide equivalent security guarantees, it does not. 2 Back in 2013, researchers identified major security flaws in both DTLS implementations and in the DTLS protocol itself, which have since been fixed, at least in the implementation of GnuTLS and OpenSSL. 2

Finally, the OP asks how application flows differ when using TLS and DTLS. TLS is designed for reliable and end-to-end data flow delivery with authenticated encryption. DTLS is designed to deliver end-to-end authenticated and encrypted application data, but with less delay than can be achieved when all the application data is guaranteed to be delivered. This is why DTLS is used to protect streaming applications where losses are less important than delays, such as VoIP, live video streams and MMO games.

PS: DTLS 1.3 is under development. 3