Offloading vs Mbed

jaredwolff

@AchimKraus do you use the MFW DTLS implementation or Mbed? Curious as to what has worked best in your testing.

Edit: I found your repo from earlier. TinyDTLS. That must be great for code size!

AchimKraus

When I started with the nRF9160 (Thingy:91) back in 2021 there was no DTLS 1.2 CID support in the modem firmware. Therefore I ported tinydtls to zephyr and built a very first version of a coap client with that. In the Deutsche Telekom - IoT Learning Week 2022 I presented the result and that triggered Nordic to ask one of the other authors of RFC 9146 (Hannes) and so they started to support CID using the mbedTLS variant.
Today I still continue to used tinydtls, because:

it’s more flexible about the timeouts, see DTLS minimum handshake timeout
it offers RawPublicKey certificates (RFC 7250), which I prefer. (Unfortunately it doesn’t offer x509, but I anyway don’t consider that for IoT :-) ).
(And finally, but that’s more a personal argument, I’m commiter in tinydtls and Californium and so that’s just a pretty well tested couple :-) ).

jaredwolff

AchimKraus Yea I was reading up on RPK. I have not used that… yet. Plenty use of signed certs and PSK.

I have found since the beginning that mbed had a ton of bloat and took up a bunch of code space. Even now with a basic application it sucks up soo much space.

Image	Flash Used	Flash Allocated	RAM Used	RAM Allocated
MCUboot	43 KB	48 KB	21 KB	64 KB
TF-M (code)	97 KB	159 KB	55 KB	64 KB
TF-M (storage)	—	80 KB	—	—
App (lion_basic)	210 KB	256 KB	56 KB	175 KB
TF-M + App	307 KB	415 KB	111 KB	239 KB

MCUboot primary/secondary slots: 416 KB each (TF-M code + app swapped together). TF-M storage (ITS, PS, NV counters) is outside the swap slots. Total flash: 1 MB.

I’ll likely do a tinyDTLS comparison to see how much is saved. Seems more than sufficient for IoT use cases but yes, we do lose out on x.509.

I am happy about the addition of CONFIG_TFM_PARTITION_PROTECTED_STORAGE though. I thought it was a little weird to be storing credentials in clear text flash. It’s still not as ideal as a secure element though.

Working on a project that will hopefully be helpful to people in the space. 🙂 I’ll probably do some content on my findings as I go.

AchimKraus

jaredwolff I thought it was a little weird to be storing credentials in clear text flash.

I guess, this mainly depends on the required security level. In my opinion, using the read-back-protection and control the app on the device should work for common applications.

https://community.circuitdojo.com/assets/files/2026-03-19/1773900104-135859-nrf9160-dk-v310.txt

That’s the rom report for one of the last versions. According that, tinydtls takes about 33K.

For more security, my plan was to use a HSM, but the ATECC608A is now for 2 years on my desk, unfortunately I hadn’t the time to work/test with it, see https://github.com/eclipse-tinydtls/tinydtls/pull/236