<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On 8 Mar 2024, at 07:47, Daniel Jeliński <djelinski1@gmail.com> wrote:</div><br class="Apple-interchange-newline"><div><div dir="ltr"><div dir="ltr">Hi Paul,</div><div>If you're interested in dealing with handshake extensions from user code, that is currently not possible. SSLEngine abstracts away all TLS messaging. SSLParameters can be used to configure a limited subset of extensions to send (like server_name or application protocol), and the negotiated application protocol can be retrieved from SSLEngine, and that's pretty much it.</div><div><br></div><div>Use_srtp extension is not currently supported by JSSE. If you want to add that support, you'd need to add the appropriate enum values to sun.security.ssl.SSLExtension, using the constructors that specify a producer and a consumer. I'm not familiar with WebRTC or SRTP, so I don't know how that would interact with the rest of the code.</div><div><br></div><div>If you have an idea how WebRTC / SRTP support could be implemented in JSSE, this is the right place for that discussion.</div><div><br></div><div>Regards,</div><div>Daniel</div></div>
</div></blockquote></div><br><div>Daniel, hi, following up on Paul’s question… </div><div><br></div><div>I've done an integration with BouncyCastle DTLS API with WebRTC’s SRTP (and indirectly paid for the api to exist), here’s what I remember was needed:</div><div><br></div><div>1) Ability to inject and receive DTLS packets via a socket-like interface</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>- WebRTC muxes several protocols onto the same 5tuple ports so we need to manage the packet traffic from a UDP socket before it gets to DTLS. </div><div><span class="Apple-tab-span" style="white-space:pre"> </span>- In some cases the DTLS packet is wrapped in a TURN packet on the wire - so you cant’t even assume the packet came in on UDP.</div><div>2) Ability to set and detect the use_srtp Extension</div><div>3) Ability to verify the self signed cert offered in the handshake</div><div>4) Ability to manage the handshake timeouts </div><div>5) Ability to extract the keyring material post handshake</div><div><br></div><div>I haven’t kept up with JSSE DTLS but I don’t remember any of those API points being available.</div><div><br></div><div>It would be nice to be able to use JDK/JSSE but to be honest I’m pretty happy with BouncyCastle.</div><div><br></div><div>There is an example of our use here :</div><div><div style="display: block;"><div style="-webkit-user-select: all; -webkit-user-drag: element; display: inline-block;" class="apple-rich-link" draggable="true" role="link" data-url="https://github.com/pipe/whipi/blob/d0fe6c06f5b34fa832d1ebce0bd228f066920da0/src/main/java/pe/pi/whipi/DTLS.java"><a style="border-radius:10px;font-family:-apple-system, Helvetica, Arial, sans-serif;display:block;-webkit-user-select:none;width:300px;user-select:none;-webkit-user-modify:read-only;user-modify:read-only;overflow:hidden;text-decoration:none;" class="lp-rich-link" rel="nofollow" href="https://github.com/pipe/whipi/blob/d0fe6c06f5b34fa832d1ebce0bd228f066920da0/src/main/java/pe/pi/whipi/DTLS.java" dir="ltr" role="button" draggable="false" width="300"><table style="table-layout:fixed;border-collapse:collapse;width:300px;background-color:#E5E6E9;font-family:-apple-system, Helvetica, Arial, sans-serif;" class="lp-rich-link-emailBaseTable" cellpadding="0" cellspacing="0" border="0" width="300"><tbody><tr><td vertical-align="center" align="center"><img style="width:300px;filter:brightness(0.97);height:150px;" width="300" height="150" draggable="false" class="lp-rich-link-mediaImage" alt="whipi.png" src="cid:4CDBDB02-148A-444B-81D8-86E98D00AE76"></td></tr><tr><td vertical-align="center"><table bgcolor="#E5E6E9" cellpadding="0" cellspacing="0" width="300" style="font-family:-apple-system, Helvetica, Arial, sans-serif;table-layout:fixed;background-color:rgba(229, 230, 233, 1);" class="lp-rich-link-captionBar"><tbody><tr><td style="padding:8px 0px 8px 0px;" class="lp-rich-link-captionBar-textStackItem"><div style="max-width:100%;margin:0px 16px 0px 16px;overflow:hidden;" class="lp-rich-link-captionBar-textStack"><div style="word-wrap:break-word;font-weight:500;font-size:12px;overflow:hidden;text-overflow:ellipsis;text-align:left;" class="lp-rich-link-captionBar-textStack-topCaption-leading"><a rel="nofollow" href="https://github.com/pipe/whipi/blob/d0fe6c06f5b34fa832d1ebce0bd228f066920da0/src/main/java/pe/pi/whipi/DTLS.java" style="text-decoration: none" draggable="false"><font color="#272727" style="color: rgba(0, 0, 0, 0.847059);">whipi/src/main/java/pe/pi/whipi/DTLS.java at d0fe6c06f5b34fa832d1ebce0bd228f066920da0 · pipe/whipi</font></a></div><div style="word-wrap:break-word;font-weight:400;font-size:11px;overflow:hidden;text-overflow:ellipsis;text-align:left;" class="lp-rich-link-captionBar-textStack-bottomCaption-leading"><a rel="nofollow" href="https://github.com/pipe/whipi/blob/d0fe6c06f5b34fa832d1ebce0bd228f066920da0/src/main/java/pe/pi/whipi/DTLS.java" style="text-decoration: none" draggable="false"><font color="#808080" style="color: rgba(0, 0, 0, 0.498039);">github.com</font></a></div></div></td></tr></tbody></table></td></tr></tbody></table></a></div></div></div><div> </div></body></html>