Indeed DTLS is a "pipe", whereas pure Noise isn't, and pure Noise doesn't have any DoS protection, which DTLS does. But indeed DTLS is a mess for other reasons

Indeed DTLS is a "pipe", whereas pure Noise isn't, and pure Noise doesn't have any DoS protection, which DTLS does. But indeed DTLS is a mess for other reasons. For WireGuard I use Noise with stronger DoS resistance and anti replay measures than DTLS, custom tailored for being a layer 3 tunnel. Details here: https://www.wireguard.io/papers/wireguard.pdf https://www.wireguard.io/papers/wireguard.pdf