Pion makes DTLS 1.3 the default after a ten-month implementation
Original title: How hard could implementing DTLS 1.3 possibly be?
The library now does a one-round-trip handshake, post-quantum key exchange, Connection IDs, 0-RTT and Encrypted Client Hello.
A Pion maintainer describes leading the pion/dtls DTLS 1.3 work after an NLnet-funded effort stalled and was handed over in January 2026. The stack had no record layer, key schedule or encryption when the group started. A Pion client and server completed a handshake in late July, and DTLS 1.3 was confirmed working in WebRTC against Chrome on August 5. DTLS 1.3 is now the default, with further work on Connection IDs, KeyUpdate and SRTP negotiation.
- The DTLS 1.3 plan had been open since February 2020; RFC 9147 landed in 2022.
- NLnet approved Theo's grant, announced on August 6, before the January 2026 handoff.
- Record-layer work started May 13 and the state machine merged June 19.
- Server Finished verified July 12 and client Finished verified July 29.
- About 400 commits landed over ten months, including more than a hundred in August.
- Products
- pion/dtls
From the original article
16 min read at joturk.net
In January 2026, I somehow ended up leading Pion's DTLS 1. 3 implementation and building most of it. It was still mostly an idea at that point, and I didn't really know how DTLS 1.
By joturk.net via Sean-Der · joturk.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.