What's the cost of securing CoAP, and how is it done?

CoAP is secured with DTLS, Datagram TLS, which is TLS adapted to run over unreliable, connectionless UDP, accessed via the coaps:// scheme, giving the same confidentiality, integrity, and authentication TLS provides for TCP. The costs are real on a constrained node. First, the DTLS handshake is expensive: it involves multiple round-trips and public-key cryptography (certificate or pre-shared-key based), which consumes RAM for handshake/session state, flash for the crypto library, and CPU/energy that matter on a battery device, and because it's over lossy UDP, DTLS must implement its own retransmission and reordering for the handshake, adding complexity. Second, per-message there's the symmetric crypto overhead and a larger packet. Mitigations used on embedded: prefer pre-shared keys or raw public keys over full certificate chains to shrink the handshake, use session resumption so a device that reconnects skips the full handshake, keep sessions alive rather than re-handshaking, choose lightweight cipher suites (e.g., ECC over RSA, AEAD ciphers), and ensure the device has correct time and the right trust anchors. The alternative emerging approach is OSCORE, which secures CoAP at the object/message layer instead of the transport, avoiding a DTLS session and surviving proxies, useful when DTLS's connection model or cost doesn't fit. So securing CoAP means DTLS (or OSCORE), and the engineering is about fitting the handshake and crypto into a constrained device's memory, CPU, and energy budget.