HTTP/3 and QUIC: A new era of speed and security?

Tim

8th September 2021

4 min read

HTTP/3 is the third and upcoming major version of the Hypertext Transfer Protocol (HTTP) used across the web.HTTP has been the main protocol on the internet since the 1990s, with the second release (HTTP/2) introduced in 2015 as a major update with many new features.

Whilst request methods and status codes will remain the same, HTTP/3 makes a departure from its predecessors by not using the Transport Control Protocol (TCP) as the underlying transport layer. Instead, HTTP/3 is implemented with QUIC (pronounced “quick”), a User Datagram Protocol (UDP) based transport layer network protocol originallydeveloped by Google.

HTTP/1 and HTTP/2 were implemented on TCP, therefore using the TCP 3-way-handshake to establish connections. In order to secure these otherwise cleartext connections, Secure Socket Layer (SSL) and Transport Layer Security (TLS)protocols were applied, however many weaknesses have been identified in these cryptographic technologies over the years. This has led to a mass of configuration, security and compatibility concerns as the protocols and associated best practices have evolved.

QUIC aims to make network connections faster by reducing the number of round trips between client and server. QUIC achieves this using UDP to establish the connection, resulting in much faster handshakes than a typical TCP connection, especially if the client previously had a connection with the server (0-RTT).QUIC has TLSv1.3 (the latest release)built directlyinto the protocol, meaning that traffic is always encrypted, simplifying the level of configuration required by administrators.  This reduces the need for yet another handshake whilst adding security and privacy. By design TLSv1.3 protects against downgrade attacks as the protocol requires a key hash of all handshake communications which is then verified by the receiver.

QUIC also advances the streams that were introduced in HTTP/2. Prior to HTTP/2 when a browser connected to asite with multiple files to retrieve, the browser would need to set up a new TCP connection to each. These short-term connections were inefficientand caused bottlenecks, particularly in loading complex pages. HTTP/2 attempted to address this with streams, where one TCP connection was established but multiple streams were used for parallel connections. Unfortunately, this introduced TCP head-of-line blocking, where losing a packet meant that the other streams would need to wait for that packet to be retransmitted. QUIC uses native multiplexing, allowing these streams to now act independently, with lost packets only impacting the streams where data has been dropped. This eliminates the head-of-line blocking inefficiencies found in HTTP/2.

HTTP/3 introduces a new Connection ID header that is used in place of the IP address and ports seen in previous iterations. This allows for the easy migration of connections between network interfaces e.g., a user switching from Wi-Fi to a mobile data connection. The Connection ID in the user’s browser does not change allowing sessions to migrate easily.

Whilst HTTP/3 makes significant speed and security enhancements, there are several factors which may impact its adoption. Its reliance on UDP is considered problematic as many organisations block or limit UDP traffic,and UDP is considered slow and CPU intensive in its implementation of QUIC. Thisis believed to be as a result of UDP being under-optimised as it has not received as much attention as TCP over the years. This may be improving according to data produced by Fastly,which showed that QUIC could be as efficient as TLSv1.3 over TCP with fewer acknowledgement packets, coalescing more packets with Generic Segmentation Offload (GSO), and increasing packet size from 1280 bytes to 1460 bytes.

Of course,such significant changestothe fundamental concepts of HTTP offers new attack surfaces, so it comes as no surprise that possible vulnerabilities and attack vectors have already been discussed. What may becomforting is that these vectors are not entirely new,in some casesderiving from existing attacks in HTTP/1 and HTTP/2, and in many cases mitigations and fixes are readily available. These discussed attack vectors include Man-in-the-Middle (MitM), UDP Amplification DoS, stream exhaustion and connection reset attacks.

Whilst still in its infancy and draft form, HTTP/3 is supported by 73% of running web browsers. It has been supported by Google Chrome and Microsoft Edge (Chromium) since April 2020 and by Mozilla Firefox since May 2021. Safari 14 also includes hidden support in a feature flag that can be enabled. Meanwhile some of the largest websites have already started using HTTP/3 including Google and Facebook. In terms of adoption there is still a long way to go until we see HTTP/3 in all corners ofthe web, but with growing support it looks like it may be set to stay.

Resources

  • Insights
  • Labs

OWASP Top 10 2021 Released

The Open Web Application Security Project (OWASP) is a not-for-profit organisation that aims, through community-led open-source projects, to improve the security of web-based software. OWASP…

What is penetration testing and why is it important to use a CREST-approved provider?

Trusting the effectiveness of your IT security controls is crucial to mitigate risks and malicious access to your systems and the information they store. Penetration…

How secure use of the cloud can digitally transform your business

Companies that move towards digital transformation can innovate more quickly, scale efficiently and reduce risk by implementing cloud security best practices. Businesses must keep up…

How to prepare your business for secure cloud migration

The cloud holds a lot of potential for organisations. Moving your IT environment to a secure cloud provides flexibility and agility. It allows your team…

Celebrating Sentrium’s contribution to cyber security

2020 is the year that remote working exploded. Businesses and the general public had to quickly adapt to new ways of working caused by the…

What is CREST and what are the benefits of using a CREST accredited company?

We’re delighted to announce that Sentrium Security is now a CREST accredited company! This is an exciting achievement for us and it’s great to be…

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…

New Exchange RCE vulnerability actively exploited

Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell.…

How effective is secure code review for discovering vulnerabilities?

We’ve recently discussed application security and the trend we’re seeing in which companies are increasingly implementing security early on in the Software Development Life Cycle…

Application Security (AppSec)

There is a movement in the IT security world that is gaining traction, and it is based around the implementation of security within applications from…

Enhancing Security in your Software Development LifeCycle – Dealing with Dependencies

The adoption of agile practices has resulted in the emergence of shift-lift testing, where testing is performed much earlier in the Software Development LifeCycle (SDLC).…

TOP