Re: [TLS] DTLS/SCTP and fragmentation

2021-04-05 Thread Martin Thomson
You could also do SCTP over DTLS, which is what WebRTC uses. On Tue, Apr 6, 2021, at 02:40, Rick van Rein wrote: > Hello Michael, > > Thank you! I was searching for options, things that should go into > DTLS, but I was unaware of the attempts of mapping it better to SCTP. > > > What about using

Re: [TLS] DTLS/SCTP and fragmentation

2021-04-05 Thread Rick van Rein
Hello Michael, Thank you! I was searching for options, things that should go into DTLS, but I was unaware of the attempts of mapping it better to SCTP. > What about using: > https://tools.ietf.org/html/draft-westerlund-tsvwg-dtls-over-sctp-bis-01 This looks very good, thank you for the pointer

Re: [TLS] DTLS/SCTP and fragmentation

2021-04-05 Thread Michael Tuexen
> On 5. Apr 2021, at 14:12, Rick van Rein wrote: > > Hi, > > Larger frames than the MTU are not just a problem to Diameter; they also > complicate the normal handshake in DTLS which is a bit of a misfit with > DTLS delivery semantics. > > Since the version is bit-swapped in DTLS, each record

Re: [TLS] DTLS/SCTP and fragmentation

2021-04-05 Thread Michael Tuexen
> On 2. Apr 2021, at 23:46, Rick van Rein wrote: > > Hello, > > I was looking into DTLS/SCTP as a carrier for Diameter. Lengths in > Diameter are 24 bit to avoid ever having to bother about that, but when > run over the preferred DTLS/SCTP carrier this may yet be a concern, so > that its only o

Re: [TLS] DTLS/SCTP and fragmentation

2021-04-05 Thread Rick van Rein
Hi, Larger frames than the MTU are not just a problem to Diameter; they also complicate the normal handshake in DTLS which is a bit of a misfit with DTLS delivery semantics. Since the version is bit-swapped in DTLS, each record can easily be distinguished as being either DTLS or TLS. Then, why n

[TLS] DTLS/SCTP and fragmentation

2021-04-02 Thread Rick van Rein
Hello, I was looking into DTLS/SCTP as a carrier for Diameter. Lengths in Diameter are 24 bit to avoid ever having to bother about that, but when run over the preferred DTLS/SCTP carrier this may yet be a concern, so that its only option is to fallback to a _separate_ TLS/TCP connection: * F