Adding some IoT feature to Bouncy castle (D)TLS implementation.

[sbernard31]

Hi,

I'm the main developer of Leshan Library. This is a Java open source implementation of LWM2M protocol hosted at Eclipse Foundation.

Currently we use Scandium (from Californium Project) as DTLS library.
This library fits our needs until now but we have some concerns about its future-proofness (Especially, there is no plan for DTLS 1.3) and there is no support of TLS which is needed for recent version of LWM2M.

So we explore some other way for the future.
I have considered to use OpenJdk but there is a lot of missing IoT Features. I contact OpenJdk security dev and they makes me understand politely that IoT is not the priority (at least this is my understanding) .

Another way would be to use Bouncycastle.
The idea of that topic is to start a discussion with maintainers to know if BouncyCastle could be our long term solution.

So first question would be : Are maintainers open to the idea to add (D)TLS IoT oriented features. Either by implemented it directly or by providing support to code contribution ?

[sbernard31]

@peterdettman, @dghgit, @cipherboy do you have any opinion about that ?

(Here is a github repository, I created where I tried to centralize information about (D)TLS issues in java world for Iot use cases)

[peterdettman]

@sbernard31 On the point of IoT-oriented features I would say we are quite open, yes. If you have specific features in mind I could comment on them individually.

Although we also do not yet have DTLS 1.3 support, it was underway at some point and I expect it to eventually get done - at least in our low-level (D)TLS API.

Thinking of possible downsides, if you are hoping to use DTLS via JSSE (as the JDK supports) that is probably not on the cards without a lot of work. I would also say async/nio support is a bit lacking, although maybe with virtual threads that's less of a pain point.

[sbernard31]

On the point of IoT-oriented features I would say we are quite open, yes. If you have specific features in mind I could comment on them individually.

Great ! thx 🙏

Here there is 2 first old questions :

• Does Bouncy Castle Support Connection ID ?  #1601
• PreShared Key support in Bouncy Castle JSSE Provider #1604

Although we also do not yet have DTLS 1.3 support, it was underway at some point and I expect it to eventually get done - at least in our low-level (D)TLS API.

If this is planned even at mid/long term, this is already a good point.

Thinking of possible downsides, if you are hoping to use DTLS via JSSE (as the JDK supports) that is probably not on the cards without a lot of work.

I think it would be great to have JSSE support but it is not mandatory for us.
I know there is some missing API in JSSE (like PSK support) so I understand this is complicated anyway.

By the way I'm curious, what is your opinion about JSSE API ? do you think it is OK and not a so good one to use OR to implement ?

I would also say async/nio support is a bit lacking, although maybe with virtual threads that's less of a pain point.

You mean currently bouncy-castle low-level API does not support async/nio ? or you're talking about bouncycastle implementation of JSSE API ?

[sbernard31]

I would also say async/nio support is a bit lacking, although maybe with virtual threads that's less of a pain point.

You mean currently bouncy-castle low-level API does not support async/nio ?

I understand this concern at least low-level API.

@peterdettman I see there is several bouncy castle users which tried to implement async API on their own.
I also see some discussion and even some code contribution about that #443

Is it something that you would like to be added ?
If yes, what is currently blocking about making that moving forward ?