DTLS
acronymcryptographynetworking
Stands for: Datagram Transport Layer Security
TLS adapted to run over UDP instead of TCP.
Datagram Transport Layer Security (RFC 9147) brings TLS's confidentiality and integrity to datagram transports that can reorder or lose packets, used for things like VPN data channels and real-time media.
DTLS is TLS adapted for datagrams, and it exists because TLS assumes a reliable ordered stream that UDP does not provide. Applications that need encryption without TCP's head-of-line blocking cannot simply run TLS over UDP, because a single lost record would break the stream the protocol depends on.
The adaptation is mostly about tolerating loss. Records are made independently decryptable so one lost packet does not poison those after it, sequence numbers become explicit rather than implicit, and the handshake gains its own retransmission and reassembly because it can no longer rely on TCP to deliver it. A cookie exchange is added to the handshake for a specific reason: without it, a spoofed source address could make the server do expensive work for a client that never existed, turning the protocol into an amplifier.
Where it shows up in practice is worth knowing. WebRTC media, many VPN implementations, and the Zscaler tunnel all use it. QUIC solves the same problem differently, building its own reliability and encryption together over UDP rather than adapting TLS records, which is why HTTP/3 went that route instead.
Also known as: dtls