What is HTTP/3?
HTTP/3 is the third and upcoming major version of the Hypertext Transfer Protocol (HTTP) used across the web. HTTP has been the main protocol on the internet since the 1990s, with the second release (HTTP/2) introduced in 2015 as a major update with many new features.
Whilst request methods and status codes will remain the same, HTTP/3 makes a departure from its predecessors by not using the Transport Control Protocol (TCP) as the underlying transport layer. Instead, HTTP/3 is implemented with QUIC (pronounced “quick”), a User Datagram Protocol (UDP) based transport layer network protocol originally developed by Google.
HTTP/1 and HTTP/2 were implemented on TCP, therefore using the TCP 3-way-handshake to establish connections. In order to secure these otherwise cleartext connections, Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols were applied, however many weaknesses have been identified in these cryptographic technologies over the years. This has led to a mass of configuration, security and compatibility concerns as the protocols and associated best practices have evolved.
What is QUIC?
QUIC aims to make network connections faster by reducing the number of round trips between client and server. QUIC achieves this using UDP to establish the connection, resulting in much faster handshakes than a typical TCP connection, especially if the client previously had a connection with the server (0-RTT).QUIC has TLSv1.3 (the latest release) built directly into the protocol, meaning that traffic is always encrypted, simplifying the level of configuration required by administrators. This reduces the need for yet another handshake whilst adding security and privacy. By design TLSv1.3 protects against downgrade attacks as the protocol requires a key hash of all handshake communications which is then verified by the receiver.
QUIC also advances the streams that were introduced in HTTP/2. Prior to HTTP/2 when a browser connected to a site with multiple files to retrieve, the browser would need to set up a new TCP connection to each. These short-term connections were inefficient and caused bottlenecks, particularly in loading complex pages. HTTP/2 attempted to address this with streams, where one TCP connection was established but multiple streams were used for parallel connections. Unfortunately, this introduced TCP head-of-line blocking, where losing a packet meant that the other streams would need to wait for that packet to be retransmitted. QUIC uses native multiplexing, allowing these streams to now act independently, with lost packets only impacting the streams where data has been dropped. This eliminates the head-of-line blocking inefficiencies found in HTTP/2.
Why HTTP/3?
HTTP/3 introduces a new Connection ID header that is used in place of the IP address and ports seen in previous iterations. This allows for the easy migration of connections between network interfaces e.g., a user switching from Wi-Fi to a mobile data connection. The Connection ID in the user’s browser does not change allowing sessions to migrate easily.
Whilst HTTP/3 makes significant speed and security enhancements, there are several factors which may impact its adoption. Its reliance on UDP is considered problematic as many organisations block or limit UDP traffic, and UDP is considered slow and CPU intensive in its implementation of QUIC. This is believed to be as a result of UDP being under-optimised as it has not received as much attention as TCP over the years. This may be improving according to data produced by Fastly, which showed that QUIC could be as efficient as TLSv1.3 over TCP with fewer acknowledgement packets, coalescing more packets with Generic Segmentation Offload (GSO), and increasing packet size from 1280 bytes to 1460 bytes.
Of course, such significant changes to the fundamental concepts of HTTP offers new attack surfaces, so it comes as no surprise that possible vulnerabilities and attack vectors have already been discussed. What may be comforting is that these vectors are not entirely new, in some cases deriving from existing attacks in HTTP/1 and HTTP/2, and in many cases mitigations and fixes are readily available. These discussed attack vectors include Man-in-the-Middle (MitM), UDP Amplification DoS, stream exhaustion and connection reset attacks.
HTTP/3 Support
Whilst still in its infancy and draft form, HTTP/3 is supported by 73% of running web browsers. It has been supported by Google Chrome and Microsoft Edge (Chromium) since April 2020 and by Mozilla Firefox since May 2021. Safari 14 also includes hidden support in a feature flag that can be enabled. Meanwhile some of the largest websites have already started using HTTP/3 including Google and Facebook. In terms of adoption there is still a long way to go until we see HTTP/3 in all corners of the web, but with growing support it looks like it may be set to stay.
Sentrium can assist with your security needs, view our penetration testing services for more details or contact us today.
