Sep 8th 2021
HTTP/3 is the third and upcoming major version of the Hypertext Transfer Protocol (HTTP) used across the web.HTTP has been the main protocol on the internet since the 1990s, with the second release (HTTP/2) introduced in 2015 as a major update with many new features.
Whilst request methods and status codes will remain the same, HTTP/3 makes a departure from its predecessors by not using the Transport Control Protocol (TCP) as the underlying transport layer. Instead, HTTP/3 is implemented with QUIC (pronounced “quick”), a User Datagram Protocol (UDP) based transport layer network protocol originallydeveloped by Google.
HTTP/1 and HTTP/2 were implemented on TCP, therefore using the TCP 3-way-handshake to establish connections. In order to secure these otherwise cleartext connections, Secure Socket Layer (SSL) and Transport Layer Security (TLS)protocols were applied, however many weaknesses have been identified in these cryptographic technologies over the years. This has led to a mass of configuration, security and compatibility concerns as the protocols and associated best practices have evolved.
QUIC aims to make network connections faster by reducing the number of round trips between client and server. QUIC achieves this using UDP to establish the connection, resulting in much faster handshakes than a typical TCP connection, especially if the client previously had a connection with the server (0-RTT).QUIC has TLSv1.3 (the latest release)built directlyinto the protocol, meaning that traffic is always encrypted, simplifying the level of configuration required by administrators. This reduces the need for yet another handshake whilst adding security and privacy. By design TLSv1.3 protects against downgrade attacks as the protocol requires a key hash of all handshake communications which is then verified by the receiver.
QUIC also advances the streams that were introduced in HTTP/2. Prior to HTTP/2 when a browser connected to asite with multiple files to retrieve, the browser would need to set up a new TCP connection to each. These short-term connections were inefficientand caused bottlenecks, particularly in loading complex pages. HTTP/2 attempted to address this with streams, where one TCP connection was established but multiple streams were used for parallel connections. Unfortunately, this introduced TCP head-of-line blocking, where losing a packet meant that the other streams would need to wait for that packet to be retransmitted. QUIC uses native multiplexing, allowing these streams to now act independently, with lost packets only impacting the streams where data has been dropped. This eliminates the head-of-line blocking inefficiencies found in HTTP/2.
HTTP/3 introduces a new Connection ID header that is used in place of the IP address and ports seen in previous iterations. This allows for the easy migration of connections between network interfaces e.g., a user switching from Wi-Fi to a mobile data connection. The Connection ID in the user’s browser does not change allowing sessions to migrate easily.
Whilst HTTP/3 makes significant speed and security enhancements, there are several factors which may impact its adoption. Its reliance on UDP is considered problematic as many organisations block or limit UDP traffic,and UDP is considered slow and CPU intensive in its implementation of QUIC. Thisis believed to be as a result of UDP being under-optimised as it has not received as much attention as TCP over the years. This may be improving according to data produced by Fastly,which showed that QUIC could be as efficient as TLSv1.3 over TCP with fewer acknowledgement packets, coalescing more packets with Generic Segmentation Offload (GSO), and increasing packet size from 1280 bytes to 1460 bytes.
Of course,such significant changestothe fundamental concepts of HTTP offers new attack surfaces, so it comes as no surprise that possible vulnerabilities and attack vectors have already been discussed. What may becomforting is that these vectors are not entirely new,in some casesderiving from existing attacks in HTTP/1 and HTTP/2, and in many cases mitigations and fixes are readily available. These discussed attack vectors include Man-in-the-Middle (MitM), UDP Amplification DoS, stream exhaustion and connection reset attacks.
Whilst still in its infancy and draft form, HTTP/3 is supported by 73% of running web browsers. It has been supported by Google Chrome and Microsoft Edge (Chromium) since April 2020 and by Mozilla Firefox since May 2021. Safari 14 also includes hidden support in a feature flag that can be enabled. Meanwhile some of the largest websites have already started using HTTP/3 including Google and Facebook. In terms of adoption there is still a long way to go until we see HTTP/3 in all corners ofthe web, but with growing support it looks like it may be set to stay.