Subject: [TLS] DTLS and bad handshake messages.

From: Fabrice Gautier <[email-masked]>
Date: Tue, 7 Jan 2014 08:54:33 -0800

Hi all,

I thought I already asked that question to the list, but can't find
the answer, so here I go:

During in DTLS handshake (over UDP), how should an implementation
handle bad/invalid messages ?

>From RFC 6347, section 1.4.2.7 explain how to handle invalid records
(in general, just ignore and discard them). From the context I assume
that this only mean something at the record layer is wrong: the header
is invalid, the record is too small, didn't decrypt/mac properly,
etc...

However, what if the record layer is perfectly valid, but something is
wrong at the message layer ? Section 4.2.2 mentions what to do in case
the message sequence number are wrong (discard repeated sequence
number, buffer future sequence number) But what to do if, for example,
a message has the right message sequence number, but is not an
expected message type ?

A TLS implementation would send an alert and close the connection.
Should a  DTLS implementation do the same ?

Thanks

-- Fabrice