Internet concept

HTTP/3 and QUIC: A new era of speed and security?

Tim

8th September 2021

4 min read

What is HTTP/3?

HTTP/3 is the third and upcoming major version of the Hypertext Transfer Protocol (HTTP) used across the web. HTTP has been the main protocol on the internet since the 1990s, with the second release (HTTP/2) introduced in 2015 as a major update with many new features.

Whilst request methods and status codes will remain the same, HTTP/3 makes a departure from its predecessors by not using the Transport Control Protocol (TCP) as the underlying transport layer. Instead, HTTP/3 is implemented with QUIC (pronounced “quick”), a User Datagram Protocol (UDP) based transport layer network protocol originally developed by Google.

HTTP/1 and HTTP/2 were implemented on TCP, therefore using the TCP 3-way-handshake to establish connections. In order to secure these otherwise cleartext connections, Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols were applied, however many weaknesses have been identified in these cryptographic technologies over the years. This has led to a mass of configuration, security and compatibility concerns as the protocols and associated best practices have evolved.

What is QUIC?

QUIC aims to make network connections faster by reducing the number of round trips between client and server. QUIC achieves this using UDP to establish the connection, resulting in much faster handshakes than a typical TCP connection, especially if the client previously had a connection with the server (0-RTT).QUIC has TLSv1.3 (the latest release) built directly into the protocol, meaning that traffic is always encrypted, simplifying the level of configuration required by administrators.  This reduces the need for yet another handshake whilst adding security and privacy. By design TLSv1.3 protects against downgrade attacks as the protocol requires a key hash of all handshake communications which is then verified by the receiver.

QUIC also advances the streams that were introduced in HTTP/2. Prior to HTTP/2 when a browser connected to a site with multiple files to retrieve, the browser would need to set up a new TCP connection to each. These short-term connections were inefficient and caused bottlenecks, particularly in loading complex pages. HTTP/2 attempted to address this with streams, where one TCP connection was established but multiple streams were used for parallel connections. Unfortunately, this introduced TCP head-of-line blocking, where losing a packet meant that the other streams would need to wait for that packet to be retransmitted. QUIC uses native multiplexing, allowing these streams to now act independently, with lost packets only impacting the streams where data has been dropped. This eliminates the head-of-line blocking inefficiencies found in HTTP/2.

Why HTTP/3?

HTTP/3 introduces a new Connection ID header that is used in place of the IP address and ports seen in previous iterations. This allows for the easy migration of connections between network interfaces e.g., a user switching from Wi-Fi to a mobile data connection. The Connection ID in the user’s browser does not change allowing sessions to migrate easily.

Whilst HTTP/3 makes significant speed and security enhancements, there are several factors which may impact its adoption. Its reliance on UDP is considered problematic as many organisations block or limit UDP traffic, and UDP is considered slow and CPU intensive in its implementation of QUIC. This is believed to be as a result of UDP being under-optimised as it has not received as much attention as TCP over the years. This may be improving according to data produced by Fastly, which showed that QUIC could be as efficient as TLSv1.3 over TCP with fewer acknowledgement packets, coalescing more packets with Generic Segmentation Offload (GSO), and increasing packet size from 1280 bytes to 1460 bytes.

Of course, such significant changes to the fundamental concepts of HTTP offers new attack surfaces, so it comes as no surprise that possible vulnerabilities and attack vectors have already been discussed. What may be comforting is that these vectors are not entirely new, in some cases deriving from existing attacks in HTTP/1 and HTTP/2, and in many cases mitigations and fixes are readily available. These discussed attack vectors include Man-in-the-Middle (MitM), UDP Amplification DoS, stream exhaustion and connection reset attacks.

HTTP/3 Support

Whilst still in its infancy and draft form, HTTP/3 is supported by 73% of running web browsers. It has been supported by Google Chrome and Microsoft Edge (Chromium) since April 2020 and by Mozilla Firefox since May 2021. Safari 14 also includes hidden support in a feature flag that can be enabled. Meanwhile some of the largest websites have already started using HTTP/3 including Google and Facebook. In terms of adoption there is still a long way to go until we see HTTP/3 in all corners of the web, but with growing support it looks like it may be set to stay.

Sentrium can assist with your security needs, view our penetration testing services for more details or contact us today.

Resources

  • Insights
  • Labs
White box penetration testing

Uncovering vulnerabilities with white box penetration testing

As a business owner or IT professional, you understand the importance of protecting your company’s sensitive data, systems and reputation from cyber threats. One of…

API penetration testing

Securing APIs through penetration testing

APIs (Application Programming Interfaces) have become the backbone of many modern applications, and indeed the foundation of some businesses services. APIs enable seamless communication between…

The importance of a post-penetration test action plan

The importance of a post-penetration test action plan

As cyber threats continue to evolve and become more sophisticated, businesses must stay one step ahead in protecting their sensitive data and network infrastructure. Penetration…

How to choose the right penetration testing partner

How to choose the right penetration testing partner for your business

In today’s digital landscape, cybersecurity threats are evolving at an alarming rate. With the growing number of cyber-attacks and data breaches, businesses must prioritise their…

IoT device security, penetration testing

Securing the Internet of Things: Penetration testing’s role in IoT device security

The world is witnessing a remarkable transformation as more devices become interconnected, forming what’s known as the Internet of Things (IoT). From smart refrigerators and…

Man working as a junior penetration tester

My first month working as a junior penetration tester

Entering the world of cyber security as a junior penetration tester has been an eye-opening experience for me. In my first month, I’ve encountered challenges,…

Password cracking: How to crack a password

An introduction to password security: How to crack a password

Online Password Cracking An online attack is performed in real-time, against live services or applications to compromise active user accounts. Such attacks typically occur when…

Application Security 101 – HTTP headers

Application Security 101 – HTTP Headers Information Disclosure

Server Header Information Disclosure The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead…

SPF, DKIM, DMARC and BIMI for Email Security

SPF, DKIM, DMARC and BIMI for Email Security

Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…

Terraform security best practices

Terraform security best practices (2022)

The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…

Security vulnerability in Follina exploit

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…