RFC 9147

The Datagram Transport Layer Security (DTLS) Protocol Version 1.3
Standards Track Obsoletes: RFC 6347
April 2022
RFC Library > TLS & DTLS > RFC 9147
Abstract: This document specifies version 1.3 of the Datagram Transport Layer Security (DTLS) protocol. DTLS 1.3 is designed to meet the same goals as TLS 1.3, adapted for datagram semantics, with reduced handshake latency, mandatory forward secrecy, and improved security properties.
Canonical source: https://www.rfc-editor.org/rfc/rfc9147  |  IETF Datatracker

1. Introduction

▶

DTLS 1.3 brings TLS 1.3 improvements to datagram protocols: mandatory ephemeral DH for forward secrecy, encrypted handshake messages, 1-RTT handshakes, and removal of legacy cryptography.

DTLS 1.3 is the recommended datagram security protocol for future 3GPP deployments where DTLS is applicable.

2. Key Changes from DTLS 1.2

▶
  • Mandatory forward secrecy: Ephemeral ECDHE required (no static DH or RSA key exchange)
  • Encrypted handshake: Server certificate encrypted (like TLS 1.3)
  • Connection ID: New extension for NAT rebinding and connection migration (critical for mobile networks)
  • Unified header: Compact record header format reduces overhead
  • ACK mechanism: Explicit ACK messages replace implicit retransmission timers
  • 0-RTT support: Early data with PSK for reduced latency (with replay caveats)

3. Connection ID Extension

▶

The Connection ID (CID) extension is a critical new feature for mobile/3GPP environments. When a UE's IP address changes (NAT rebinding, handover), the CID allows the server to identify the DTLS association without requiring a new handshake.

Mobile Network Benefit: Connection ID enables seamless DTLS session continuity across UE mobility events (handover, NAT rebinding) without expensive re-handshake, reducing signaling load on the core network.

4. Record Layer Changes

▶

DTLS 1.3 uses a unified header format with two variants:

Feature DTLS 1.2 DTLS 1.3
Header size 13 bytes fixed 1-5 bytes (variable)
Epoch 2 bytes explicit 2 bits or CID-based
Sequence number 6 bytes explicit 1-2 bytes (compressed)
Version in header Yes No (removed)
Connection ID Not supported Variable length

5. Security Improvements

▶
  • Removed: RC4, DES, 3DES, static RSA, static DH, CBC mode, compression, renegotiation
  • Mandatory AEAD: Only authenticated encryption (AES-GCM, ChaCha20-Poly1305, AES-CCM)
  • Anti-replay: Improved replay detection with ACK-based retransmission
  • DoS protection: HelloRetryRequest with cookie (stateless server until cookie verified)
  • Key schedule: HKDF-based key derivation identical to TLS 1.3