4 ms·
I have a related question to the OP. What security would you recommend to run on an unreliable connection? To be specific, I have IoT devices which connect to
by steve_gh 5y ago
I have a related question to the OP.
What security would you recommend to run on an unreliable connection?
To be specific, I have IoT devices which connect to the cloud using MQTT-SN. We use MQTT-SN because the underlying connection is NB-IoT (required for high penetration into difficult to reach areas). The latency on NB-IoT is quite high, which can lead to problems with TCP timeouts - so we have been recommended by the network operator to use UDP not TCP, which in turn leads to MQTT-SN, as it supports QoS 0 (unacknowledged).
But we are also very aware of security issues - so how would you put something like TLS onto a UDP datastream?
- walrus01 5y agoI am not the OP but openvpn in its default UDP mode, with long timeouts and frequent keepalives set on both client and server side, works quite well on unreliable connections. All of the crypto available in whatever is the latest version of openssl is available for use. If setting it up in a new config these days you would want to limit it to TLS1.3 and associated cipher suites only.
- afics 5y agoFor TLS over UDP there's DTLS [0] which is probably still problematic for your use case since it still requires the typical TLS handshake. [0] https://datatracker.ietf.org/doc/html/rfc6347 https://datatracker.ietf.org/doc/html/rfc6347
- Skunkleton 5y agowireguard might be a good solution for you. https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/
- Karrot_Kream 5y agoIn addition to what others have said, NNCP [1] is an interesting way forward also. Though NNCP may not be stable enough for your purposes. [1]: http://www.nncpgo.org/ http://www.nncpgo.org/