Repository navigation
DTLS Discussion #2398
Description
There's been an ongoing, unresolved discussion around adding DTLS support to joyent/node.
The original PR (nodejs/node-v0.x-archive#6704) is not going to be able to land and needs to continue here. Discussion also happening here: nodejs/node-v0.x-archive#25354. I am closing the original PR but want to make sure the conversation is not lost.
Activity
natbro commentedon Aug 17, 2015
so @migounette, implicit answer to your question is: here in the io.js fork :) i have time this week to help move your PR (joyent/node#6704) over here if you want to share a branch? or just let me know and i can help test & work on samples + documentation for now. happy to give API feedback as well when you're ready.
looking through the original PR, it seems like getting ipv6 and DTLS 1.2 wired up would be useful (i might even suggest ditching DTLS 1.0. io.js uses >= OpenSSL 1.0.2 and may be worth leaving DTLS 1.0 cruft behind).
I'm USA west-coast time-zone, UTC−08:00. lmk if you prefer email or glitter chat to chatting here.
jasnell commentedon Aug 17, 2015
Well... it's not technically an io.js fork any more ;-). But updating this would be awesome.
natbro commentedon Aug 17, 2015
sorry, trigger word :) let's just say HEAD
migounette commentedon Aug 17, 2015
@natbro GMT+1 :) but working late
I agree DTLS 1.2 will be the target
I will re-start the activity Thursday or Friday
jorangreef commentedon Aug 18, 2015
I don't think adding DTLS to core would be as profitable as improving UDP performance and adding support for userspace networking (skipping the kernel control plane to avoid unnecessary memcopies, system calls etc.).
DTLS is also quite old now compared to a protocol such as QUIC, which has advantages over DTLS (e.g. packet-aligned encryption), although QUIC is also complex.
I have been working on a simpler protocol taking many ideas from Dan Bernstein's protocols, QUIC etc. and combining these. Improving UDP performance and Crypto performance would really help.
YurySolovyov commentedon Aug 18, 2015
I think DTLS is used in WebRTC, which is quite popular in messaging/communications apps.
jorangreef commentedon Aug 18, 2015
@YuriSolovyov thanks, then it would be good to do I guess.
rgillan commentedon Aug 18, 2015
Hello,
DTLS is a requirement for many IoT applications and it isn't relevant whether people have opinions on how efficient it is. Standards fora such as oneM2M and LWM2M have already decided to use DTLS, as well as WebRTC. Always happy to have constructive involvement but please read back through the thread before adding to this discussion
Cheers Rob
Rantanen commentedon Aug 18, 2015
Yes. While DTLS is not "optimal" or "best" - it's used which makes it important and required for many scenarios, the main ones for Node are WebRTC and IoT as stated above.
Also tying DTLS directly to UDP will make it challenging to implement WebRTC on top of it. WebRTC multiplexes different protocols on top of the same UDP socket - some of which use DTLS and some which don't use.
Essentially WebRTC would require a DTLS implementation similar to the
TLSSocketthat can be invoked from JS code with user defined packets. This way the user code can first resolve whether the packets use DTLS or not according to WebRTC specification and then pass the DTLS packets to the DTLS implementation.I've been a bit silent on this front lately seeing where and how the feature gets momentum. While I still want to finish the
node-dtlsproject I started, I'm having difficulties figuring out what to do next given there's just so many different things that would need improvement.If @migounette is continuing the native DTLS implementation, you can count me in for whatever resources. Be it code (to some extent anyway), API design, test cases - either for unit testing or integration for WebRTC purposes. I'm happy as long as Node gets some way to use DTLS.
avesus commentedon Aug 18, 2015
👍 Shure, DTLS support for WebRTC will be market-changer for Node.
mcollina commentedon Aug 19, 2015
Just adding that DTLS is needed for the CoAP protocol see coapjs/node-coap#11.
The need for DTLS to be in core comes from OpenSSL. Maintaining another version of OpenSSL inside an user-land module is extremely complicated.
I'm 👍 in having a separate module, plus maybe a stream-like interface for DTLS over UDP (but that can be on NPM).
ohord commentedon Aug 19, 2015
+1 DTLS will enable ability to implement secure IoT servers and clients in node.js
natbro commentedon Aug 20, 2015
@mcollina - when you say "stream-like interface for DTLS over UDP" what do you mean? in terms of writing without specifying a destination host+port as currently required with
dgram.send? in terms of in-order delivery/re-assembly of longer-than-MTU sized buffers?53 remaining items
mcollina commentedon Aug 2, 2017
I am happy to join a biweekly team, if someone has time to put into the implementation.
saghul commentedon Aug 3, 2017
I'm happy to participate in discussions or code review, but I'm afraid I won't be able to contribute code myself. Agreed with Ben, libuv-extras seems like the right place for it.
LinusU commentedon Nov 21, 2017
Would absolutely love to see this happen. I think it would help a lot since IoT is becoming very popular, especially in connection with Node.js.
migounette commentedon Mar 28, 2018
It's time for DTLS !!! @saghul you have a project but seems to be empty: https://github.com/libuv/libuv-extras
Any clue for starting ?
saghul commentedon Mar 29, 2018
@migounette Creating the source and header files, together with a simple Makefile should be enough to get the ball rolling. We'll see where we go from there :-) (I've been afk for some time, so I don't know if any decisions have been made regarding the extras repo in the mean time.)
reklatsmasters commentedon Jun 9, 2018
Few month ago i`m started working on pure js dtls implementation. Here is my experimental work:
https://github.com/nodertc/dtls. AEAD, ECDSA, mtu, reordering, defragmentation already implemented.
bu5hm4nn commentedon Jun 15, 2018
Hello everyone. Needing to bridge this gap ASAP we at Krekeltronics have looked for a solution. The best we have found so far is Spark's module for inclusion of mbedtls library into node. Since we did not get the impression that there was any maintaining or further development going on in that repo or in others downstream, we have decided to take on further developing the module.
We would appreciate any input you may have toward getting this code production ready. Feel free to comment on the roadmap and the tickets, help us test the code or submit pull requests.
Take a look at the project: https://github.com/krekeltronics/node-mbed-dtls
Join the discussion on Gitter:
jasnell commentedon Oct 25, 2018
Closing due to lack of activity
soyuka commentedon Oct 26, 2018
Has this been implemented? Isn't it considered as an option to add it to the core?
AndreMaz commentedon Jan 24, 2019
@jasnell @mcollina @bnoordhuis @saghul is there any chance of reopening this? DTLS continues to be a missing piece to secure IoT
migounette commentedon Jan 24, 2019
I am eager to pariticapte to DTLS implementation
But currently it's not very clear where changes.
I have a native implementation of DTLS on top of nodejs 10 (NAPI) for our WebRTC product
DTLS is widely used by WebRTC and IO-T, in java the need is covered with COaP but in Node.JS no efficient solution.
DTLS (UDP) uses 80% of TLS code and it requires only a few hooks in order to support key exchange (such as https://tools.ietf.org/html/rfc5764)
LibUV/No LibUV, in Core/No Core.... pushing our work to community will be great just let us know where to push it and how we can discuss API changes, impacts and documentation.
The real question, we have stuff to push but we need some to lead the job in order to take decisions where it can be put.
My 2 cents
mcollina commentedon Jan 24, 2019
@migounette It would be good if you could issue a PR adding DTLS to Node Core. Why would you need changes in libuv?
AndreMaz commentedon Jan 24, 2019
Wow @migounette ! It would be amazing if you could create a PR with DTLS
AndreMaz commentedon Feb 14, 2019
@migounette I think that the official guide "Contributing a new API to N-API" can provide some guidance