Game Development Stack Exchange is a question and answer site for professional and independent game developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am considering using the DTLS protocol for my online multiplayer game. For those who don't know, it is essentially a port of TLS to UDP datagrams.

According to this paper, the main overhead of the protocol is in the handshake phase, which took 950 ms in their tests. However, this study (broken link; see copy on indicates that during actual encrypted transport, there is often less than 1 millisecond of delay.

This sounds like a godsend for realtime games. It is a low latency, highly secure encrypted channel that operates over UDP. It provides reliability and protection for the handshake phase, then steps out of the way. Yet, I have never heard of it being used in a game before, even though the RFC spec was written in 2006 and it's implemented in OpenSSL.

Why doesn't every game use it?

share|improve this question
I don't know, it sounds great... Maybe it isn't supported in many popular languages? Are there good and working libraries for it? I don't use it simply because I haven't heard of it and I doubt node.js supports it... – jcora Dec 3 '11 at 14:23 "Why doesn't every game use it" doesn't get to the problem at heart: whether or not it's useful for your purposes. – Tetrad Dec 4 '11 at 19:30
@Tetrad The problem at heart is that it sounds great but it's not widely used. That is the last mystery in determining whether it is useful for my purposes. – Kai Dec 5 '11 at 1:28
@Tetrad I agree. However, knowing the history of the libraries I choose is important to me. Certainly, if it IS popular, that makes development much easier. – Kai Dec 5 '11 at 13:50
Out of curiosity, how do you know that games don't use it? – Trevor Powell Dec 6 '11 at 12:26
up vote 3 down vote accepted

Why doesn't every game use it? Firstly, I doubt most people have even heard of this protocol. Network security is not well-known among game developers and this is a fairly obscure variant anyway. Secondly, not every game uses UDP. Thirdly, performance is a concern. A fifth of a millisecond delay on every 200 byte packet obviously means you can only handle 5000 packets a second even if your system does absolutely nothing else (which is unlikely). And there's the comparison of write performance - encryption can be more expensive than decryption.

share|improve this answer

What would the benefits be?

Do not mistake obfuscation as a method of security in multiplayer games. Being able to intercept/inject traffic is not normally a concern, as a client should not be able to modify gamestate beyond normal parameters (aka cheat) anyway. If you're encrypting traffic as a means to avoid this then you're probably writing your netcode wrong, and need to move more of the simulation serverside.

So.. in answer to your question - security of this sort does not usually matter in games.

Sorry if I perhaps misunderstood. Maybe you could outline why you think games should use this. You may then find an answer to your question (if this is not it)

share|improve this answer
Encryption like this benefits players the same way TLS on a website does - it means no one besides the game operator, who you trust, is submitting requests for you or snooping on what you're doing. For example, no one is intercepting your packets and making you trade items. No one is faking chat logs in your name. – user744 Dec 3 '11 at 23:02
Importantly, it can be used for secure transactions, such as purchasing an item from the shop. Aside from that, it prevents packet sniffing and man-in-the-middle attacks. It's not a replacement for the dumb terminal but it does seem like an easy and cheap way to completely eliminate a vector of attack. – Kai Dec 3 '11 at 23:12
Both valid points. Apologies for missing that :S However, the question did say "every game", and focused on low-latency real-time games, where as the above 2 cases above seem limited to mmorpgs. So, in answer to "every game" I would still say that in most cases it is not necessary. (I don't think the above 2 would be of use in a game of crysis, for instance) – ProPuke Dec 4 '11 at 14:47
For things like buying items or sending chat, just have a regular HTTPS API. There's no reason at all that the whole game has to run over some action-focused optimized UDP protocol, unless you have some crazy bandwidth concerns (which DTLS is going to screw over anyway; you need to pad packets out to avoid message-size-based attacks). – Sean Middleditch Feb 12 '13 at 0:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.