3 ms·

QUIC is TLS-equivalent, not TCP-equivalent. The analogy you're looking for is something like openssl's SSL_* API and.. it's coming for QUIC: https://www.openss

QUIC is TLS-equivalent, not TCP-equivalent. The analogy you're looking for is something like openssl's SSL_* API and.. it's coming for QUIC: https://www.openssl.org/docs/manmaster/man7/openssl-quic.html https://www.openssl.org/docs/manmaster/man7/openssl-quic.htm... There are dozen of libs to do it right now but I expect ultimately distro folks will want to consolidate it all to avoid redundant dependencies, so we'll probably end up with openssl/gnutls/libressl doing it eventually and most apps using that. Note there were talks to add it in-kernel like kTLS, but since the certificate handling is difficult that part will be offloaded to userspace as it is with kTLS -- you won't ever get an interface like connect() and forget about it.

rewmie 3y ago
> QUIC is TLS-equivalent, not TCP-equivalent. From Wikipedia[1]: "QUIC improves performance of connection-oriented web applications that are currently using TCP.[QUIC] is designed to obsolete TCP at the transport layer for many applications, thus earning the protocol the occasional nickname "TCP/2"." Also taken from the wiki page: "QUIC aims to be nearly equivalent to a TCP connection but with much-reduced latency." Here is the only relevant bit regarding TLS: "As most HTTP connections will demand TLS, QUIC makes the exchange of setup keys and supported protocols part of the initial handshake process. When a client opens a connection, the response packet includes the data needed for future packets to use encryption. This eliminates the need to set up the TCP connection and then negotiate the security protocol via additional packets." [1] https://en.m.wikipedia.org/wiki/QUIC https://en.m.wikipedia.org/wiki/QUIC
- evgpbfhnr 3y ago
  The RFCs for QUIC (RFC 9000 and RFC 9001) mandate encryption. Some random stackoverflow answer[1] claims there are implementations that ignore this and allow "QUIC without encryption", but I'd argue that it's not QUIC anymore -- in my opinion it'd be harmful to implement in the kernel. [1] https://stackoverflow.com/a/72828565/2332808 https://stackoverflow.com/a/72828565/2332808
  - MerManMaid 3y ago
    Per the RFC, QUIC is literally defined as a transport protocol... Literally the first sentence of the overview is: "QUIC is a secure general-purpose transport protocol." More importantly, QUIC literally bakes in TLS into how it works which is a far cry away from replacing it. "The QUIC handshake combines negotiation of cryptographic and transport parameters. QUIC integrates the TLS handshake [TLS13], although using a customized framing for protecting packets."

rewmie 3y ago

> QUIC is TLS-equivalent, not TCP-equivalent. From Wikipedia[1]: "QUIC improves performance of connection-oriented web applications that are currently using TCP.[QUIC] is designed to obsolete TCP at the transport layer for many applications, thus earning the protocol the occasional nickname "TCP/2"." Also taken from the wiki page: "QUIC aims to be nearly equivalent to a TCP connection but with much-reduced latency." Here is the only relevant bit regarding TLS: "As most HTTP connections will demand TLS, QUIC makes the exchange of setup keys and supported protocols part of the initial handshake process. When a client opens a connection, the response packet includes the data needed for future packets to use encryption. This eliminates the need to set up the TCP connection and then negotiate the security protocol via additional packets." [1] https://en.m.wikipedia.org/wiki/QUIC https://en.m.wikipedia.org/wiki/QUIC

evgpbfhnr 3y ago
The RFCs for QUIC (RFC 9000 and RFC 9001) mandate encryption. Some random stackoverflow answer[1] claims there are implementations that ignore this and allow "QUIC without encryption", but I'd argue that it's not QUIC anymore -- in my opinion it'd be harmful to implement in the kernel. [1] https://stackoverflow.com/a/72828565/2332808 https://stackoverflow.com/a/72828565/2332808
- MerManMaid 3y ago
  Per the RFC, QUIC is literally defined as a transport protocol... Literally the first sentence of the overview is: "QUIC is a secure general-purpose transport protocol." More importantly, QUIC literally bakes in TLS into how it works which is a far cry away from replacing it. "The QUIC handshake combines negotiation of cryptographic and transport parameters. QUIC integrates the TLS handshake [TLS13], although using a customized framing for protecting packets."