Analysis of QUIC Session Establishment and Its Implementations

Abstract

In the recent years, the major web companies have been working to improve the user experience and to secure the communications between their users and the services they provide. QUIC is such an initiative, and it is currently being designed by the IETF. In a nutshell, QUIC originally intended to merge features from TCP/SCTP, TLS 1.3 and HTTP/2 into one big protocol. The current specification proposes a more modular definition, where each feature (transport, cryptography, application, packet reemission) are defined in separate internet drafts. We studied the QUIC internet drafts related to the transport and cryptographic layers, from version 18 to version 23, and focused on the connection establishment with existing implementations. We propose a first implementation of QUIC connection establishment using Scapy, which allowed us to forge a critical opinion of the current specification, with a special focus on the induced difficulties in the implementation. With our simple stack, we also tested the behaviour of the existing implementations with regards to security-related constraints (explicit or implicit) from the internet drafts. This gives us an interesting view of the state of QUIC implementations.

Revisiting QUIC attacks: a comprehensive review on QUIC security and a hands-on study

“…In most cases, the QUIC handshake was ended after 2-3 packets, unable to complete the TLS handshake, since the transmitted QUIC packet was malformed. However, in some fewer cases, the fuzzer managed to perform a full handshake and receive some data, validating the observations of the work in [51] regarding the frame mangling attack.…”

“…Gagliardi and Levillain [51] studied the QUIC transport and cryptographic layers in the related Internet drafts from version 18 to version 23. They focused on the connection establishment in existing implementations, testing them for security issues with the aid of the Scapy Python library.…”

Revisiting QUIC attacks: A comprehensive review on QUIC security and a hands-on study

“…Reflective amplification [52] State overflow [52] Frame mangling [51] Missing parameters [51] Packet length manipulation [51] Version forgery [49,51] QUIC RST [49] DoS [31,47,49,52] Replay [31,48] Downgrade [31,50] Crypto Stream Offset [31] Packet manipulation [31]…”

“…Another identified issue is related to the Frame mangling attack [51]. Specifically, when running the Munityfuzzer it was observed that, similarly to the Frame mangling attack, the fuzzer was able to pass arbitrary QUIC packets to the server either during the TLS handshake or throughout the HTTP service.…”

On the interplay between TLS certificates and QUIC performance

“…Prior work suggests that some security trade-offs were specifically made in favor of improved latency [32]. The handshake, however, can suffer from additional latency if client and server do not agree on a version directly [11].…”