D04-RI: Yes
Rationale
Over already provisioned IPv6/UDP access, the DTLS client can supply an additional locally generated external PSK and identity through per-object callbacks. These credentials are distinct from the host interface address and can belong to separate ordinary user processes without modifying shared routes or interfaces.
Assessment method
Source/API provenance and bounded documentary witness; no execution
Source context
Pinned wolfSSL source and DTLS 1.3 specification
Outstanding qualification
The counterpart must explicitly provision and accept the new distinct pairwise credential; this is the peer-acceptance condition allowed by D04, not automatic trust. Use secure random secrets and user-owned stores. This credits credential creation/use above authorized transport, not privilege-free installation of 802.15.4/RPL or independence from the peer that shares the secret. No additional application authentication is introduced.
Public sources
- https://raw.githubusercontent.com/wolfSSL/wolfssl/eb113cac674a9f7da61a70a6307a7db959753ccf/wolfssl/ssl.h
- https://raw.githubusercontent.com/wolfSSL/wolfssl/eb113cac674a9f7da61a70a6307a7db959753ccf/src/ssl.c
- https://raw.githubusercontent.com/wolfSSL/wolfssl/eb113cac674a9f7da61a70a6307a7db959753ccf/src/tls13.c
- https://www.rfc-editor.org/rfc/rfc9147.html
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round271-sources.json