DTLS 1.3 adoption urged for post-quantum security

The transition from DTLS 1.2 to DTLS 1.3 is gaining urgency as organizations prepare for post-quantum cryptography. Unlike its predecessor, DTLS 1.3 provides a clear migration path to quantum-resistant algorithms, a capability DTLS 1.2 lacks entirely. This shift is particularly relevant for industries relying on long-lived embedded devices or secure UDP-based communications, where confidentiality must extend for years or decades.

Performance and security improvements

DTLS 1.3 introduces several technical refinements that address limitations in DTLS 1.2. The most notable change is the reduction of the handshake process from two round trips to one, cutting latency by half in typical network conditions. For example, at a 200 ms round-trip time (RTT), DTLS 1.3 completes the handshake in approximately 200 ms, compared to 400 ms for DTLS 1.2. This improvement is further amplified in lossy environments: when a single datagram is lost at a 50 ms RTT, DTLS 1.3 recovers in 53 ms, while DTLS 1.2 requires 1,107 ms—a 20-fold difference.

Beyond latency, DTLS 1.3 incorporates an acknowledgment mechanism that detects and repairs lost datagrams immediately, a feature absent in DTLS 1.2. The protocol also supports Connection IDs, which enable stable communication for constrained devices even when network addresses change. Additionally, 0-RTT early data allows for faster reconnections, reducing overhead for applications that frequently reestablish sessions.

Post-quantum readiness

The most compelling argument for upgrading to DTLS 1.3 is its compatibility with post-quantum cryptography (PQC). DTLS 1.2 has no pathway to support PQC algorithms, leaving it vulnerable to future quantum computing threats. DTLS 1.3, in contrast, supports all three NIST-standardized PQC algorithm families: ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) for authentication. These can be deployed in hybrid modes, such as combining X25519 with ML-KEM-768, to maintain security during the transition period.

wolfSSL, an early adopter of DTLS 1.3, has integrated these PQC algorithms into its production-ready implementation. The company also offers a minimal client-only build optimized for constrained devices, as well as kernel-space operation for environments requiring low-level efficiency. Regular interoperability testing against NSS ensures compatibility, and preparations are underway for similar tests once OpenSSL adds DTLS 1.3 support.

Deployment considerations

For organizations still using DTLS 1.2, the upgrade to DTLS 1.3 is straightforward with wolfSSL’s implementation, which has been available since the RFC’s publication. The library’s small footprint makes it suitable for embedded systems, while its support for session export—currently in development—will enable zero-downtime deployments and seamless load balancing by allowing live sessions to be serialized and transferred between servers.

What to watch

The next major milestone for DTLS 1.3 is the completion of session export functionality, which will further simplify high-availability deployments. As OpenSSL’s DTLS 1.3 implementation nears release, broader interoperability testing will become possible, potentially accelerating adoption across the ecosystem. Meanwhile, the ongoing standardization of PQC algorithms ensures that DTLS 1.3 will remain a critical tool for securing UDP traffic in the post-quantum era.