保护 UDP - OpenSSL 或 GnuTls 或...？
我需要保护我的 UDP 流量。据我了解，DTLS 协议是最好的方法。还有另一种 - IPsec - 但它看起来不适合我，因为它不容易使用并且可能存在硬件问题。
我发现有些库实现了 DTLS。所以现在我正在尝试选择 - OpenSSL 还是 GnuTls？你能建议我用什么更好吗？有什么缺点或优点？或者可能有另一个库实现了 DTLS 支持？
I need to secure my UDP traffic. As far as I understand DTLS protocol is the best way to do it. There is another one - IPsec - but it looks not applicable for me because it's not easy to use and there are possible hardware problems.
I've found that there are some libraries which have DTLS implemented. So now I'm trying to choose - OpenSSL or GnuTls? Could you please advise me what is better to use? What are drawbacks or advantages? Or may be there is another library with DTLS support implemented?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我发现了以下有关库和 DTLS 的事实。
还有另一个支持 DTLS 的库 - CyaSSL，但目前仅在测试模式下支持 DTLS。
虽然 RFC 4347 的日期是 2006 年 4 月，但 OpenSSL 自 2005 年 (v0.9.8) 起就支持 DTLS。许多 Linux 发行版都包含此版本。 OpenSSL API 看起来有点丑，但看起来 DTLS 实现很稳定。
GnuTls 自 2011 年 (v3.0.0) 起支持 DTLS。看起来 Linux 还没有包含这个版本。 （例如，Ubuntu 11.04 使用 v2.8.6，Ubuntu 11.10 将使用 v2.10.5，而不是 v3.0.0。）没有关于何时使用 v3.0 的信息。它可以手动构建，但是它依赖于太多额外的库，这些库在某些发行版中可能没有本机支持。
看起来所有这些库都可以在其他平台（例如Windows）上使用。
已知的 OpenSSL 问题：OpenSSL 默认情况下为 DTLS 启用压缩，但事实并非如此。 OpenSSL v0.9.8 API 不提供任何禁用压缩的方法。该方法应手动实现。
摘要：
说到可用性，我个人更喜欢 GnuTls API，但目前 OpenSSL 看起来更适合使用。
I've found the following facts about the libraries and DTLS.
There is another lib with DTLS support - CyaSSL, but it supports DTLS only in test mode for now.
Although RFC 4347 dates from Apr, 2006, the OpenSSL supports DTLS since 2005 (v0.9.8). Many Linux distribs include this version. OpenSSL API looks ugly a little, but it seems like DTLS implementation is stable.
GnuTls supports DTLS since 2011 (v3.0.0). Looks like no Linux includes this version yet. (For example, Ubuntu 11.04 uses v2.8.6, Ubuntu 11.10 is going to use v2.10.5, not v3.0.0.) There is no information about when v3.0 will be used. It can be built manually, however it depends on too many additional libraries which may have no native support in some distribs.
It looks like all of these libraries can be used on other platforms (e.g. Windows).
Known OpenSSL issue: OpenSSL has compression enabled by default for DTLS, but it shouldn't be. OpenSSL v0.9.8 API doesn't provide any method to disable compression. The method should be implemented manually.
SUMMARY:
Speaking about usability, personally I would prefer GnuTls API, but at the time OpenSSL looks more preferable to use.
IPsec 是最古老的，因此最兼容和稳定，但需要系统管理员执行任务，并且对于新手来说可能相当具有挑战性。 DTLS 正在从应用程序方面解决问题，程序员可以通过较少的更改来显着简化并与现有环境集成。
OpenSSL 和 GnuTLS 之间的选择几乎总是取决于许可证。
OpenSSL 许可证包含广告条款：
来自维基百科的 GnuTLS：
http://en.wikipedia.org/wiki/GnuTLS
IPsec is the oldest and hence most compatible and stable, but requires tasks from the sysadmin and can be quite challenging for novices. DTLS is tackling the problem from the application side which the programmer can significantly simplify and integrate with existing environments with less change.
The choice between OpenSSL and GnuTLS is almost always due to license.
OpenSSL license includes an advertising clause:
GnuTLS from Wikipedia:
http://en.wikipedia.org/wiki/GnuTLS