  Similarly to elsewhere on the Internet, practical security in the Internet of
Things (IoT) is achieved by combining an array of mechanisms, at work at all
layers of the protocol stack, in system software, and in hardware. Standard
protocols such as Datagram Transport Layer Security (DTLS 1.2) and Transport
Layer Security (TLS 1.2) are often recommended to secure communications to/from
IoT devices. Recently, the TLS 1.3 standard was released and DTLS 1.3 is in the
final stages of standardization. In this paper, we give an overview of version
1.3 of these protocols, and we provide the first experimental comparative
performance analysis of different implementations and various configurations of
these protocols, on real IoT devices based on low-power microcontrollers. We
show how different implementations lead to different compromises. We measure
and compare bytes-over-the-air, memory footprint, and energy consumption. We
show that, when DTLS/TLS 1.3 requires more resources than DTLS/TLS 1.2, this
additional overhead is quite reasonable. We also observe that, in some
configurations, DTLS/TLS 1.3 actually decreases overhead and resource
consumption. All in all, our study indicates that there is still room to
optimize the existing implementations of these protocols.
