Draft: draft-ietf-tls-dtls13

Commentary: It gets reset each time the epoch does . Do n't talk about values as being scoped only per association .
Paragraph (version A):
Each DTLS record contains a sequence number to provide replay
protection.  Sequence number verification SHOULD be performed using
the following sliding window procedure, borrowed from Section 3.4.3
of RFC4303.
Paragraph (version A):
The received record counter for an association MUST be initialized to
zero when that association is established.  For each received record,
the receiver MUST verify that the record contains a sequence number
that does not duplicate the sequence number of any other record
received during the lifetime of the association.  This check SHOULD
happen after deprotecting the record; otherwise the record discard
might itself serve as a timing channel for the record number.  Note
that computing the full record number from the partial is still a
potential timing channel for the record number, though a less
powerful one than whether the record was deprotected.
Paragraph (version B):
Each DTLS record contains a sequence number to provide replay
protection.  Sequence number verification SHOULD be performed using
the following sliding window procedure, borrowed from Section 3.4.3
of RFC4303.  Because each epoch resets the sequence number space, a
separate sliding window is needed for each epoch.
Paragraph (version B):
The received record counter for an epoch MUST be initialized to zero
when that epoch is first used.  For each received record, the
receiver MUST verify that the record contains a sequence number that
does not duplicate the sequence number of any other record received
in that epoch during the lifetime of the association.  This check
SHOULD happen after deprotecting the record; otherwise the record
discard might itself serve as a timing channel for the record number.
Note that computing the full record number from the partial is still
a potential timing channel for the record number, though a less
powerful one than whether the record was deprotected.
Paragraph (version A):
The "right" edge of the window represents the highest validated
sequence number value received on the association.  Records that
contain sequence numbers lower than the "left" edge of the window are
rejected.  Records falling within the window are checked against a
list of received records within the window.  An efficient means for
performing this check, based on the use of a bit mask, is described
in Section 3.4.3 of RFC4303.  If the received record falls within the
window and is new, or if the record is to the right of the window,
then the record is new.
Paragraph (version B):
The "right" edge of the window represents the highest validated
sequence number value received in the epoch.  Records that contain
sequence numbers lower than the "left" edge of the window are
rejected.  Records falling within the window are checked against a
list of received records within the window.  An efficient means for
performing this check, based on the use of a bit mask, is described
in Section 3.4.3 of RFC4303.  If the received record falls within the
window and is new, or if the record is to the right of the window,
then the record is new.