F15-RI: Yes
Rationale
The selected DTLS 1.3 layer supplies a native stateless-cookie admission mechanism. Configure the receiving leaf's DTLS server to issue HelloRetryRequest and retain no pending handshake state until the returned cookie verifies. Cookie authentication binds the client's address and a compact transcript representation under a server secret. This defers persistent handshake allocation and subsequent handshake/application processing until return-routability admission, satisfying F15 at that identified boundary.
Assessment method
Primary documentation and pinned source review; no runtime experiment
Source context
DTLS 1.3 stateless-cookie handshake admission and TLS transcript cookie
Outstanding qualification
This is an explicit cookie-enabled architectural witness, not a claim about every DTLS default or a qualified integrated leaf executable. Parsing, transcript hashing and a bounded-size keyed cookie operation still occur before admission; restrained cookie processing is required by RFC 9147 section 11. No per-request pending-handshake table is credited before validation. Fragment reassembly, lower-layer queues and 6LoWPAN/RPL processing are outside this protected boundary and require their own limits. Cookies do not establish PSK authorization and do not stop attacks from valid reachable addresses. The selected external-PSK handshake and final-peer policy remain necessary after admission. No CPU service floor, radio-capacity protection, full-process quota, runtime result or D01 implementation qualification is inferred.
Public sources
- https://www.rfc-editor.org/rfc/rfc9147.html#section-5.1
- https://www.rfc-editor.org/rfc/rfc9147.html#section-11
- https://www.rfc-editor.org/rfc/rfc8446.html#section-4.2.2
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round539.html
- round539-sources.json