2

I am using an application which is sending application data using MQTT-SN application Layer protocol. I have encrypted the UDP port using DTLS.

Now the question is if i have to reinitialize a handshake for every PUB/SUB packet i want to send through client or i can save that session once created and use it for indefinite period.

2

There are in fact two different questions here.

Q: Do i have to reinitialize a handshake for every PUB/SUB packet i want to send through a client?

A: No.

A DTLS handshake is very expensive, so preserving/resuming the same session for every subsequent pub/sub interaction seems like a very good idea, especially given a constrained environment (which is assumed to be in place somewhere for all of the MQTT-SN usage scenarios outlined in the section 3 of the spec).

In fact, RFC 7925 "TLS/DTLS Profiles for the Internet of Things", Section 7 "Session Resumption" strongly suggests exactly that.

Note that if your environment is not constrained in any way and doesn't have anything to do with the Internet of Things at all, you would want to consider replacing MQTT-SN with something else.

Q: Can I use a session created once for indefinite period of time?

A: Sort of yes, but depends on the period.

A DTLS session does not age given appropriate session ciphers, if this is the question. However, after a certain period of time you may still want to drop it and initialize a new one through a new handshake.

A simple example of when it makes sense to do so is when on January, 1st, you connect to a server with a TLS certificate valid till March, 1st. At the end of February you may want to re-check if the remote endpoint still operates the server name you're connecting to by requesting another handshake and checking if the certificate had been updated.

Depending on how the remote endpoint authentication (both for publishers and subscribers) is designed in your case (e.g. physical security tokens), there could be different restrictions that you may want to impose.

| improve this answer | |
  • 1
    Thanks for your elaborate answer. And to answer your recommendation actually yes we are using constrained devices i.e. IoT so the choice of MQTT-SN is only option for our case. – Muhammad Ahsan Apr 24 '19 at 6:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.