Re: [TLS] Interest in taking draft-seggelmann-tls-dtls-heartbeat-01 as a working group item

[Daniel Mentz <[e-mail]>]

I endorse this document and suggest to take it up as a TLS working group 
item.

Without the DTLS heartbeat extension, an endpoint is unable to find out 
whether its peer is still alive and whether it still has the DTLS 
connection state. This state is necessary to decrypt and verify DTLS 
records.

An application that is based on the request/response paradigm might 
detect this situation if the peer fails to respond. However, 
unidirectional applications like IPFIX never send any kind of response. 
draft-mentz-ipfix-dtls-recommendations-01 elaborates on this issue.

The heartbeat extension can also be used to perform PMTU discovery in an 
elegant way.

Speaking about the PMTU: I suggest that DTLS implementations provide 
upper layers with the maximum size of user messages. Even if the PMTU is 
known to the application, it is unable to determine the maximum size of 
user messages because the overhead incurred by the DTLS record layer 
depends on the negotiated cipher suite. If the DTLS layer does not 
provide the maximum message size, it should at least provide the amount 
of overhead incurred by DTLS.

-Daniel Mentz