Subject: [tsvwg] SSL connections with SCTP

From: Elmar Stellnberger <[email-masked]>
Date: Wed, 8 May 2019 17:03:22 +0200

I am planning to write a proxy for localhost which relays incoming tcp 
connections via an SCTP connection to a remote host. That way it should 
be possible to overcome lacking SCTP support for browsers. Now my 
question is how to best use SSL with SCTP. If I have established an open 
  SSL SCTP connection and want to fork a new flow for the same 
connection do I have to repeat the SSL cipher negotiation or may I 
simply fork an existing SSL SCTP flow?

---

From: Michael Tuexen <[email-masked]>
Date: Wed, 8 May 2019 22:19:15 +0200

> On 8. May 2019, at 17:03, Elmar Stellnberger <[email-masked]> wrote:
> 
> I am planning to write a proxy for localhost which relays incoming tcp connections via an SCTP connection to a remote host. That way it should be possible to overcome lacking SCTP support for browsers. Now my question is how to best use SSL with SCTP. If I have established an open  SSL SCTP connection and want to fork a new flow for the same connection do I have to repeat the SSL cipher negotiation or may I simply fork an existing SSL SCTP flow?
> 
I would suggest to use DTLS/SCTP. This is supported by OpenSSL and you can
find some examples at https://github.com/nplab/DTLS-Examples.

Best regards
Michael

---

From: Caitlin Bestler <[email-masked]>
Date: Thu, 9 May 2019 18:56:39 +0000

Who is supplying the identity information? If it is the host then you want to secure the SCTP association. If it is the specific application then it would make so to do so on a per-Stream basis. What would make no sense isto have the host apply a host-wide policy on a per-stream basis.

________________________________
From: tsvwg <[email-masked]> on behalf of Michael Tuexen <[email-masked]>
Sent: Wednesday, May 8, 2019 1:19 PM
To: Elmar Stellnberger
Cc: tsvwg
Subject: Re: [tsvwg] SSL connections with SCTP

I would suggest to use DTLS/SCTP. This is supported by OpenSSL and you can
find some examples at https://github.com/nplab/DTLS-Examples.
[https://avatars0.githubusercontent.com/u/12073177?s=400&v=4]<https://github.com/nplab/DTLS-Examples>

GitHub - nplab/DTLS-Examples: DTLS Examples for OpenSSL<https://github.com/nplab/DTLS-Examples>
github.com
DTLS Examples for OpenSSL. This repository contains examples for DTLS via SCTP and UDP. Each application in src can be used as client or server.. Our examples are developed against the OpenSSL 1.1.x API.

Best regards
Michael