DTLS (Datagram Transport Layer Security)

  • It is a version of the TLS (Transport Layer Security) protocol, but for UDP (User Datagram Protocol).

  • It is mainly used in network applications that require secure communication, but where speed and low latency are priorities, such as voice and video calls, online games , and streaming.

  • Main Features of DTLS :

    • Low-latency security : DTLS allows fast and secure communication without the delivery and ordering guarantees of TCP, which is essential for real-time applications.

    • Connection independence : Since UDP does not establish a formal "connection," DTLS must also handle sessions securely even without the guaranteed connection steps of TCP.

    • Optional retransmission support : DTLS tries to retransmit important data (such as parts of the initial handshake) if packet loss compromises the authentication process, but this retransmission is limited since UDP's priority is to minimize latency.

  • Generating an X509 Certificate for the DTLS Security Protocol in Godot .

    • A .crt file (certificate) and a .key file (encryption key) are generated.

    • The certificate is created and used during the Client-to-Server connection process.

Usage in Godot 4 with ENetMultiplayerPeer

  • Server: 

const _x509 : X509Certificate = preload('res://certificados/X509_certificado.crt')
const _key : CryptoKey = preload('res://certificados/X509_key.key')

func create_gateway_server() -> Error:
    var peer := ENetMultiplayerPeer.new()
    var erro : Error = peer.create_server(GATEWAY_PORT, MAX_CONNECTIONS)
    if erro:
        return erro
        
    peer.get_host().dtls_server_setup(TLSOptions.server(_key, _x509))
        
    get_tree().set_multiplayer(_gateway_server, get_path())
    _gateway_server.set_multiplayer_peer(peer)

    return OK

  • Client: 

const _x509 : X509Certificate = preload('res://certificados/X509_certificado.crt')

func join_gateway_server() -> Error: 
    var peer := ENetMultiplayerPeer.new()
    var erro := peer.create_client(_SERVER_IP_DEFAULT, GATEWAY_PORT)
    if erro:
        return erro
        
    peer.get_host().dtls_client_setup(_SERVER_IP_DEFAULT, TLSOptions.client_unsafe(_x509))
        
    get_tree().set_multiplayer(_gateway_server, get_path())
    _gateway_server.set_multiplayer_peer(peer)
        
    return OK

  • Tested and works 100%.

    • If you use TLSOptions.client()  instead of TLSOptions.client_unsafe() , errors occur and the connection is not established, as expected.

    • If the certificate differs between Client and Server, errors occur and the connection is not established, as expected.