On the interplay between TLS certificates and QUIC performance

Abstract

In this paper, we revisit the performance of the QUIC connection setup and relate the design choices for fast and secure connections to common Web deployments. We analyze over 1M Web domains with 272k QUIC-enabled services and find two worrying results. First, current practices of creating, providing, and fetching Web certificates undermine reduced round trip times during the connection setup since sizes of 35% of server certificates exceed the amplification limit. Second, non-standard server implementations lead to larger amplification factors than QUIC permits, which increase even further in IP spoofing scenarios. We present guidance for all involved stakeholders to improve the situation.

On Cross-Layer Interactions of QUIC, Encrypted DNS and HTTP/3: Design, Evaluation, and Dataset

“…The authors confirm lower latencies for Internet transfers over QUIC, in cloud storage with certain file sizes, and with video streaming. In [45], the authors look at QUIC connection setup performance, more specifically at the the size and compression of TLS certificates, due to the impact in the handshake phase. Finally, [46] evaluates the performance of several QUIC implementations over several emulated and real-world geostationary satellite links.…”

“…Since 2022, HTTP/3 [56] is the most recent version of HTTP and it promises performance and security improvements [33,34,37] Measurement on DNS adoption [26,35] DNS encryption and its performance [13,15,36,38] Security analysis of DNS protocols [38,39] QUIC Deployment and adoption [40,41] QUIC with IoT [42] Performance of QUIC over different networks [23,43,44] QUIC's performance over different workloads [22] QUIC and TLS interplay [45] QUIC over satellites [46] HTTP/3 (H3)…”

Web Privacy By Design: Evaluating Cross-layer Interactions of QUIC, DNS and H/3

“…the authors report poor performance for QUIC, specially when there is packet loss. [31,32,35] Measurement on DNS adoption [33,36] DNS encryption and its performance [13,15,34,37] Security analysis of DNS protocols [37,38] QUIC Deployment and adoption [40,41] QUIC with IoT [42] Performance of QUIC over different networks [23,43,44] QUIC's performance over different workloads [22] QUIC and TLS interplay [45] QUIC over satellites [46] HTTP/3 (H3)…”

Secure Middlebox-Assisted QUIC

“…Moreover, we assume that QUIC Address Validation Using Retry Packets [6, Sec. 8.1.2] is disabled: While previous work showed that enforcing the traffic amplification limit effectively safeguards against amplification attacks, Address Validation Using Retry Packets can safely be skipped, thereby reducing first time connection establishments by 1×RTT [11].…”