Draft: draft-ietf-tls-dtls13

Commentary: This should make things correct . We might consider getting rid of the term connection or association entirely , but each is problematic : association is a historical term but we also use connection a lot anyway . 
 It 's a shame that " association " is so firmly entrenched . I do n't see " association " being used much anyway . Good that you have removed " session " though .
Paragraph (version A):
connection: A transport-layer connection between two endpoints.
Paragraph (version A):
handshake: An initial negotiation between client and server that
establishes the parameters of their transactions.
Paragraph (version B):
association: Shared state between two endpoints established with a
DTLS handshake.
Paragraph (version B):
connection: Synonym for association.
Paragraph (version B):
handshake: An initial negotiation between client and server that
establishes the parameters of the connection.
Paragraph (version A):
session: An association between a client and a server resulting
from a handshake.
Paragraph (version A):
The received record counter for a session MUST be initialized to zero
when that session is established.  For each received record, the
receiver MUST verify that the record contains a sequence number that
does not duplicate the sequence number of any other record received
during the lifetime of the session.  This check SHOULD happen after
deprotecting the record; otherwise the record discard might itself
serve as a timing channel for the record number.  Note that computing
the full record number from the partial is still a potential timing
channel for the record number, though a less powerful one than
whether the record was deprotected.
Paragraph (version B):
The received record counter for an association MUST be initialized to
zero when that association is established.  For each received record,
the receiver MUST verify that the record contains a sequence number
that does not duplicate the sequence number of any other record
received during the lifetime of the association.  This check SHOULD
happen after deprotecting the record; otherwise the record discard
might itself serve as a timing channel for the record number.  Note
that computing the full record number from the partial is still a
potential timing channel for the record number, though a less
powerful one than whether the record was deprotected.
Paragraph (version A):
The "right" edge of the window represents the highest validated
sequence number value received on the session.  Records that contain
sequence numbers lower than the "left" edge of the window are
rejected.  Records falling within the window are checked against a
list of received records within the window.  An efficient means for
performing this check, based on the use of a bit mask, is described
in Section 3.4.3 of RFC4303.  If the received record falls within the
window and is new, or if the record is to the right of the window,
then the record is new.
Paragraph (version B):
The "right" edge of the window represents the highest validated
sequence number value received on the association.  Records that
contain sequence numbers lower than the "left" edge of the window are
rejected.  Records falling within the window are checked against a
list of received records within the window.  An efficient means for
performing this check, based on the use of a bit mask, is described
in Section 3.4.3 of RFC4303.  If the received record falls within the
window and is new, or if the record is to the right of the window,
then the record is new.