[Apologies, resending as text]

Hi,

I've been working on an implementation of DTLS 1.3 in Mbed TLS, basically as a side project. For transparency, I have used AI heavily in this work, but I am fully accountable for the code.

Obviously, this is a large quantity of code. I would appreciate your feedback on the following plan [1]: I could break the contribution into 7-8 PRs (first PR about 1k LOC, largest PR 5-6K). I would ensure from day one that the new functionality remains off by default and avoid any changes to existing TLS and DTLS 1.2 behavior. Then we could have users try it out for a while as opt-in, and only then the project team can decide to enable it by default.

The code base is available as a branch [2] and is accompanied by copious documentation [3]. Recently I updated the code in line with both 4.2.0 of this library and the new version -02 of the rfc9147bis Internet Draft. The code includes unit tests, integration tests and interoperability testing with wolfSSL. I have also run multiple security reviews of the code and reviewed it manually, and I'm ready to iterate as needed to follow the project's processes.

If you are open to this plan, I will open a tracking issue right away and follow with smallish PR1.

Looking forward to contributing to this community! Thanks,

Yaron

[1] https://github.com/yaronf/mbedtls/blob/dtls13/local-docs/upstream-dtls13-pr-...

[2] https://github.com/yaronf/mbedtls/tree/dtls13

[3] https://github.com/yaronf/mbedtls/tree/dtls13/local-docs