Securing the Next Version of HTTP: How QUIC and HTTP/3 Compare to HTTP/2
summary
QUIC is an always‑encrypted UDP transport carrying HTTP/3 and moves TCP/TLS features into the transport: packet headers are integrity‑protected and header protection masks use a 16‑byte sample, stream frames carry application data, and servers are limited by a 3× amplification limit before address validation. Connection IDs are variable (0–20 byte connection IDs) and stateless resets use an HMAC/HKDF token. Session resumption enables zero‑RTT is replayable and lacks forward secrecy, so servers must treat early data as potentially duplicated.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:11Protocol Stack
- 2:25Transport Handshake
- 5:28Address Validation
- 7:03Transport Parameters
- 7:51Packet Headers
- 8:50Connection IDs
- 11:31Crypto Handshake
- 23:14Security Considerations
- 25:24Address Validation Tokens
- 27:19ZeroRTT Handshake
- 33:13Summary
related talks
46mHTTP/3: It's all about the transport!
51mHTTP/3 and QUIC: Who, what, where, when and, WHY?
37mHTTP/3: why and where are we?
30mHTTP/3 Is Next Generation HTTP. Is It QUIC Enough?
40mHTTP/3 - HTTP over QUIC is the next generation
34mHTTP/3 is coming
34mQUIC and HTTP/3: Too Big to Fail?!
35mOn QUIC, HTTP/3 and tech stack unification