Low-Power IoT Communication Security: On the Performance of DTLS and TLS 1.3
This study is significant for developers and researchers working on securing low-power IoT devices, as it offers practical insights into the performance implications of adopting the newer DTLS/TLS 1.3 standards.
This paper provides the first experimental comparative performance analysis of DTLS/TLS 1.3 and 1.2 implementations on low-power IoT microcontrollers, measuring bytes-over-the-air, memory footprint, and energy consumption. It found that while DTLS/TLS 1.3 sometimes requires more resources, the overhead is reasonable, and in some configurations, it actually decreases overhead and resource consumption compared to 1.2.
Similarly to elsewhere on the Internet, practical security in the Internet of Things (IoT) is achieved by combining an array of mechanisms, at work at all layers of the protocol stack, in system software, and in hardware. Standard protocols such as Datagram Transport Layer Security (DTLS 1.2) and Transport Layer Security (TLS 1.2) are often recommended to secure communications to/from IoT devices. Recently, the TLS 1.3 standard was released and DTLS 1.3 is in the final stages of standardization. In this paper, we give an overview of version 1.3 of these protocols, and we provide the first experimental comparative performance analysis of different implementations and various configurations of these protocols, on real IoT devices based on low-power microcontrollers. We show how different implementations lead to different compromises. We measure and compare bytes-over-the-air, memory footprint, and energy consumption. We show that, when DTLS/TLS 1.3 requires more resources than DTLS/TLS 1.2, this additional overhead is quite reasonable. We also observe that, in some configurations, DTLS/TLS 1.3 actually decreases overhead and resource consumption. All in all, our study indicates that there is still room to optimize the existing implementations of these protocols.