handshake message may be fragmented over several DTLS records, each of which is
intended to fit in a single IP datagram. Each DTLS handshake message contains both a
fragment offset and a fragment length. Thus, a recipient in possession of all bytes of a
handshake message can reassemble the original unfragmented message.
TLS和DTLS握手消息可能非常大(理论上最多为2^24-1字节,实际上是很多KB)。相反,如果不
需要IP分段,UDP数据报通常限制在<1500字节。为了补偿此限制,每个DTLS握手消息可以在多个
DTLS记录上分段,每个DTLS记录都旨在适合单个IP数据报。每个DTLS握手消息都包含片段偏移量
和片段长度。因此,拥有握手消息的所有字节的接收者可以重新组合原始的未分段消息。
3.3. Replay Detection
3.3. 重放检测
DTLS optionally supports record replay detection. The technique used is the same as in
IPsec AH/ESP, by maintaining a bitmap window of received records. Records that are too
old to fit in the window and records that have previously been received are silently
discarded. The replay detection feature is optional, since packet duplication is not always
malicious, but can also occur due to routing errors. Applications may conceivably detect
duplicate packets and accordingly modify their data transmission strategy.
DTLS可选地支持记录重播检测。使用的技术与IPsec AH/ESP中的相同,通过维护接收记录的位图
窗口。太旧而无法放入窗口的记录和以前收到的记录将被自动丢弃。重播检测功能是可选的,因为
数据包复制并不总是恶意的,但也可能由于路由错误而发生。可以想象,应用程序可以检测重复分
组并相应地修改其数据传输策略。
4. Differences from TLS
4. 与TLS的区别
As mentioned in Section 3, DTLS is intentionally very similar to TLS. Therefore, instead of
presenting DTLS as a new protocol, we present it as a series of deltas from TLS 1.2 [TLS12].
Where we do not explicitly call out differences, DTLS is the same as in [TLS12].
如第3节所述,DTLS有意与TLS非常相似。因此,我们没有将DTLS作为一个新协议来表示,而是将
其表示为TLS1.2[TLS12]中的一系列增量。当我们没有明确指出差异时,DTL与[TLS12]中的相同。
4.1. Record Layer
4.1. 记录层
The DTLS record layer is extremely similar to that of TLS 1.2. The only change is the
inclusion of an explicit sequence number in the record. This sequence number allows the
recipient to correctly verify the TLS MAC. The DTLS record format is shown below:
DTLS记录层与TLS 1.2非常相似。唯一的变化是在记录中包含一个显式序列号。此序列号允许收件
人正确验证TLS MAC。DTLS记录格式如下所示:
struct {
ContentType type;
ProtocolVersion version;
uint16 epoch; // New field
uint48 sequence_number; // New field