Analysis of QUIC Session Establishment and its Implementations Eva - - PowerPoint PPT Presentation

▶
analysis of quic session establishment and its
SMART_READER_LITE
LIVE PREVIEW

Analysis of QUIC Session Establishment and its Implementations Eva - - PowerPoint PPT Presentation

Feb 20, 2024 361 likes •1.08k views

Analysis of QUIC Session Establishment and its Implementations Eva Gagliardi 1 , 2 Olivier Levillain 1 1 Tlcom SudParis 2 French Ministry of the Armies Sminaire SoSySec May 29th 2020 E. Gagliardi, O. Levillain (TSP/MinArm) QUIC Session

slide-1
SLIDE 1

Analysis of QUIC Session Establishment and its Implementations

Eva Gagliardi1,2 Olivier Levillain1

1Télécom SudParis 2French Ministry of the Armies

Séminaire SoSySec May 29th 2020

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 1 / 29

slide-2
SLIDE 2

Introduction QUIC in a Nutshell QUIC Packet Protection A Look at QUIC Draft 23 Implementations Conclusion and Perspectives

slide-3
SLIDE 3

Introduction QUIC in a Nutshell QUIC Packet Protection A Look at QUIC Draft 23 Implementations Conclusion and Perspectives

slide-4
SLIDE 4

Introduction

@pictyeye

Olivier Levillain ◮ M2 internship on the FORK-256 hash function (2006) ◮ member of the systems security lab at ANSSI (2007-2012) ◮ head of the network security lab at ANSSI (2012-2015) ◮ head of the training center at ANSSI (2015-2018) ◮ associate professor at Télécom SudParis (2018-)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 4 / 29

slide-5
SLIDE 5

Introduction

@pictyeye

Olivier Levillain ◮ M2 internship on the FORK-256 hash function (2006) ◮ member of the systems security lab at ANSSI (2007-2012) ◮ head of the network security lab at ANSSI (2012-2015) ◮ head of the training center at ANSSI (2015-2018) ◮ associate professor at Télécom SudParis (2018-) Research ◮ low-level security mechanisms in x86 CPUs (ACPI, SMM) ◮ PhD on SSL/TLS ◮ studies on the langages ◮ work on parsers and on network protocol implementations

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 4 / 29

slide-6
SLIDE 6

Introduction

Documents and tools

https://paperstreet.picty.org ◮ my PhD manuscript (if you are into TLS) ◮ articles and slides for most of my contributions and seminars

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 5 / 29

slide-7
SLIDE 7

Introduction

Documents and tools

https://paperstreet.picty.org ◮ my PhD manuscript (if you are into TLS) ◮ articles and slides for most of my contributions and seminars Active software projects ◮ Parsifal, a parser generator written in OCaml

◮ https://github.com/picty/concerto

◮ Concerto, a tool to analyse TLS campaigns and certificate chains

◮ https://github.com/picty/parsifal

◮ Wombat, one more Bleichenbacher toolkit

◮ https://gitlab.com/pictyeye/wombat

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 5 / 29

slide-8
SLIDE 8

Introduction

The GASP project

a Generic Approach to Secure network Protocols (2019-2022) ◮ description of protocol messages using simple languages ◮ network scans at large to better understand real world ecosystems ◮ description of protocol state machines using simple languages ◮ security evaluation of concrete implementation using different techniques (message-level fuzzing, state machine inference)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 6 / 29

slide-9
SLIDE 9

Introduction

The GASP project

a Generic Approach to Secure network Protocols (2019-2022) ◮ description of protocol messages using simple languages ◮ network scans at large to better understand real world ecosystems ◮ description of protocol state machines using simple languages ◮ security evaluation of concrete implementation using different techniques (message-level fuzzing, state machine inference) Work in progress ◮ a platform to test and compare parser generators ◮ experimentations to fuzz existing state machines with L⋆

◮ reproduction of existing results on TLS ◮ extension to the discovery of Bleichenbacher oracles ◮ performance improvement

◮ application to DNS, TLS, QUIC, SSH

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 6 / 29

slide-10
SLIDE 10

Introduction

The GASP project

a Generic Approach to Secure network Protocols (2019-2022) ◮ description of protocol messages using simple languages ◮ network scans at large to better understand real world ecosystems ◮ description of protocol state machines using simple languages ◮ security evaluation of concrete implementation using different techniques (message-level fuzzing, state machine inference) Work in progress ◮ a platform to test and compare parser generators ◮ experimentations to fuzz existing state machines with L⋆

◮ reproduction of existing results on TLS ◮ extension to the discovery of Bleichenbacher oracles ◮ performance improvement

◮ application to DNS, TLS, QUIC, SSH

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 6 / 29

slide-11
SLIDE 11

Introduction

Warnings about this presentation

Most of the material presented here comes from the work from Eva Gagliardi (2019 internship) and was presented at WISTP last December

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 7 / 29

slide-12
SLIDE 12

Introduction

Warnings about this presentation

Most of the material presented here comes from the work from Eva Gagliardi (2019 internship) and was presented at WISTP last December The experiments were made against draft-23 implementations and may not accurately reflect on the current state of the ecosystem (current version is draft-28, mostly with minor changes regarding the session establishment)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 7 / 29

slide-13
SLIDE 13

Introduction QUIC in a Nutshell QUIC Packet Protection A Look at QUIC Draft 23 Implementations Conclusion and Perspectives

slide-14
SLIDE 14

QUIC in a Nutshell

gQUIC and QUIC in a nutshell

◮ 2012: Google proposes a new protocol, QUIC

◮ multiplexed HTTP in a secure channel over UDP

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 9 / 29

slide-15
SLIDE 15

QUIC in a Nutshell

gQUIC and QUIC in a nutshell

◮ 2012: Google proposes a new protocol, QUIC

◮ multiplexed HTTP in a secure channel over UDP

◮ 2014: First drafts about TLS 1.3, borrowing some ideas

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 9 / 29

slide-16
SLIDE 16

QUIC in a Nutshell

gQUIC and QUIC in a nutshell

◮ 2012: Google proposes a new protocol, QUIC

◮ multiplexed HTTP in a secure channel over UDP

◮ 2014: First drafts about TLS 1.3, borrowing some ideas ◮ 2016: QUIC is proposed as an IETF item

◮ the original protocol is renamed gQUIC ◮ a new IETF WG is formed (quic) ◮ a more modular design is proposed, with the soon-to-be TLS 1.3 as the secure transport

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 9 / 29

slide-17
SLIDE 17

QUIC in a Nutshell

gQUIC and QUIC in a nutshell

◮ 2012: Google proposes a new protocol, QUIC

◮ multiplexed HTTP in a secure channel over UDP

◮ 2014: First drafts about TLS 1.3, borrowing some ideas ◮ 2016: QUIC is proposed as an IETF item

◮ the original protocol is renamed gQUIC ◮ a new IETF WG is formed (quic) ◮ a more modular design is proposed, with the soon-to-be TLS 1.3 as the secure transport

◮ 2018:TLS 1.3 publication (RFC8446)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 9 / 29

slide-18
SLIDE 18

QUIC in a Nutshell

gQUIC and QUIC in a nutshell

◮ 2012: Google proposes a new protocol, QUIC

◮ multiplexed HTTP in a secure channel over UDP

◮ 2014: First drafts about TLS 1.3, borrowing some ideas ◮ 2016: QUIC is proposed as an IETF item

◮ the original protocol is renamed gQUIC ◮ a new IETF WG is formed (quic) ◮ a more modular design is proposed, with the soon-to-be TLS 1.3 as the secure transport

◮ 2018:TLS 1.3 publication (RFC8446) ◮ 2019-2020: ongoing work on QUIC drafts (leading to -draft28 versions)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 9 / 29

slide-19
SLIDE 19

QUIC in a Nutshell

gQUIC and QUIC in a nutshell

◮ 2012: Google proposes a new protocol, QUIC

◮ multiplexed HTTP in a secure channel over UDP

◮ 2014: First drafts about TLS 1.3, borrowing some ideas ◮ 2016: QUIC is proposed as an IETF item

◮ the original protocol is renamed gQUIC ◮ a new IETF WG is formed (quic) ◮ a more modular design is proposed, with the soon-to-be TLS 1.3 as the secure transport

◮ 2018:TLS 1.3 publication (RFC8446) ◮ 2019-2020: ongoing work on QUIC drafts (leading to -draft28 versions) Warning: this presentation is about IETF QUIC only

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 9 / 29

slide-20
SLIDE 20

QUIC in a Nutshell

A Typical QUIC Connection

Client Server Uses UDP Packets

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 10 / 29

slide-21
SLIDE 21

QUIC in a Nutshell

A Typical QUIC Connection

Client Server QUIC Initial (ClientHello) Uses UDP Packets Initial Protection

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 10 / 29

slide-22
SLIDE 22

QUIC in a Nutshell

A Typical QUIC Connection

Client Server QUIC Initial (ClientHello) QUIC Initial (ServerHello) Uses UDP Packets Initial Protection

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 10 / 29

slide-23
SLIDE 23

QUIC in a Nutshell

A Typical QUIC Connection

Client Server QUIC Initial (ClientHello) QUIC Initial (ServerHello) QUIC Handshake (EncryptedExtensions + Certificate + CertVerify + Finished) Uses UDP Packets Initial Protection Handshake Secrets

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 10 / 29

slide-24
SLIDE 24

QUIC in a Nutshell

A Typical QUIC Connection

Client Server QUIC Initial (ClientHello) QUIC Initial (ServerHello) QUIC Handshake (EncryptedExtensions + Certificate + CertVerify + Finished) QUIC Handshake (Finished) Uses UDP Packets Initial Protection Handshake Secrets

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 10 / 29

slide-25
SLIDE 25

QUIC in a Nutshell

A Typical QUIC Connection

Client Server QUIC Initial (ClientHello) QUIC Initial (ServerHello) QUIC Handshake (EncryptedExtensions + Certificate + CertVerify + Finished) QUIC Handshake (Finished) QUIC 1 RTT (Application data) Uses UDP Packets AppData after 1 RTT Initial Protection Handshake Secrets Traffic Secrets

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 10 / 29

slide-26
SLIDE 26

QUIC in a Nutshell

1RTT?

The efficiency of the session establishment is usually measured in the number of Round-Trip Times (RTTs) required before the first application data can be exchanged

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 11 / 29

slide-27
SLIDE 27

QUIC in a Nutshell

1RTT?

The efficiency of the session establishment is usually measured in the number of Round-Trip Times (RTTs) required before the first application data can be exchanged ◮ TLS (≤ 1.2) typically offers 3 RTT (TCP + 2)...

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 11 / 29

slide-28
SLIDE 28

QUIC in a Nutshell

1RTT?

The efficiency of the session establishment is usually measured in the number of Round-Trip Times (RTTs) required before the first application data can be exchanged ◮ TLS (≤ 1.2) typically offers 3 RTT (TCP + 2)...

◮ 2 RTT (TCP + 1) with session resumption

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 11 / 29

slide-29
SLIDE 29

QUIC in a Nutshell

1RTT?

The efficiency of the session establishment is usually measured in the number of Round-Trip Times (RTTs) required before the first application data can be exchanged ◮ TLS (≤ 1.2) typically offers 3 RTT (TCP + 2)...

◮ 2 RTT (TCP + 1) with session resumption

◮ TLS 1.3 typically offers 2 RTT (TCP + 1)...

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 11 / 29

slide-30
SLIDE 30

QUIC in a Nutshell

1RTT?

The efficiency of the session establishment is usually measured in the number of Round-Trip Times (RTTs) required before the first application data can be exchanged ◮ TLS (≤ 1.2) typically offers 3 RTT (TCP + 2)...

◮ 2 RTT (TCP + 1) with session resumption

◮ TLS 1.3 typically offers 2 RTT (TCP + 1)...

◮ 1 RTT (TLS 1.3 0 RTT mode) with session resumtion, under conditions

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 11 / 29

slide-31
SLIDE 31

QUIC in a Nutshell

1RTT?

The efficiency of the session establishment is usually measured in the number of Round-Trip Times (RTTs) required before the first application data can be exchanged ◮ TLS (≤ 1.2) typically offers 3 RTT (TCP + 2)...

◮ 2 RTT (TCP + 1) with session resumption

◮ TLS 1.3 typically offers 2 RTT (TCP + 1)...

◮ 1 RTT (TLS 1.3 0 RTT mode) with session resumtion, under conditions

◮ QUIC, thanks to UDP, is really 1 RTT in common cases...

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 11 / 29

slide-32
SLIDE 32

QUIC in a Nutshell

1RTT?

The efficiency of the session establishment is usually measured in the number of Round-Trip Times (RTTs) required before the first application data can be exchanged ◮ TLS (≤ 1.2) typically offers 3 RTT (TCP + 2)...

◮ 2 RTT (TCP + 1) with session resumption

◮ TLS 1.3 typically offers 2 RTT (TCP + 1)...

◮ 1 RTT (TLS 1.3 0 RTT mode) with session resumtion, under conditions

◮ QUIC, thanks to UDP, is really 1 RTT in common cases...

◮ or even 0 RTT under conditions

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 11 / 29

slide-33
SLIDE 33

QUIC in a Nutshell

1RTT?

The efficiency of the session establishment is usually measured in the number of Round-Trip Times (RTTs) required before the first application data can be exchanged ◮ TLS (≤ 1.2) typically offers 3 RTT (TCP + 2)...

◮ 2 RTT (TCP + 1) with session resumption

◮ TLS 1.3 typically offers 2 RTT (TCP + 1)...

◮ 1 RTT (TLS 1.3 0 RTT mode) with session resumtion, under conditions

◮ QUIC, thanks to UDP, is really 1 RTT in common cases...

◮ or even 0 RTT under conditions

However, do not forget that TCP is not slow on purpose, and that connection-oriented communications have benefits

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 11 / 29

slide-34
SLIDE 34

QUIC in a Nutshell

Variants from the Happy Path

Version Negotiation ◮ in case the server does not like the client version ◮ the server sends its supported versions in a VersionNegotiation ◮ and the client has to come back

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 12 / 29

slide-35
SLIDE 35

QUIC in a Nutshell

Variants from the Happy Path

Version Negotiation ◮ in case the server does not like the client version ◮ the server sends its supported versions in a VersionNegotiation ◮ and the client has to come back Retry Mechanism ◮ if the server wants to validate the return path ◮ it answers with a Retry message including a token ◮ and the client has to come back with the token

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 12 / 29

slide-36
SLIDE 36

QUIC in a Nutshell

Variants from the Happy Path

Version Negotiation ◮ in case the server does not like the client version ◮ the server sends its supported versions in a VersionNegotiation ◮ and the client has to come back Retry Mechanism ◮ if the server wants to validate the return path ◮ it answers with a Retry message including a token ◮ and the client has to come back with the token TLS 1.3 Hello Retry Request ◮ if the TLS 1.3 ClientHello does not contain sufficient information ◮ the server Initial Packet will contain a TLS 1.3 HelloRetryRequest ◮ and the client has to come back with an updated ClientHello

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 12 / 29

slide-37
SLIDE 37

QUIC in a Nutshell

QUIC Main Goals and Features

Performance properties ◮ low-latency session establishment (1 RTT or even 0 RTT) ◮ stream multiplexing within a shared connection ◮ low bandwidth usage (variable length fields)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 13 / 29

slide-38
SLIDE 38

QUIC in a Nutshell

QUIC Main Goals and Features

Performance properties ◮ low-latency session establishment (1 RTT or even 0 RTT) ◮ stream multiplexing within a shared connection ◮ low bandwidth usage (variable length fields) Security properties ◮ state-of-the-art cryptographic primitives ◮ privacy-oriented measures ◮ countermeasures against UDP amplification attacks

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 13 / 29

slide-39
SLIDE 39

QUIC in a Nutshell

QUIC Main Goals and Features

Performance properties ◮ low-latency session establishment (1 RTT or even 0 RTT) ◮ stream multiplexing within a shared connection ◮ low bandwidth usage (variable length fields) Security properties ◮ state-of-the-art cryptographic primitives ◮ privacy-oriented measures ◮ countermeasures against UDP amplification attacks Compatibility with internet (debatable) ◮ detailed description of the protocol invariants across versions ◮ encrypt as much as possible (only parts of the header are in cleartext)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 13 / 29

slide-40
SLIDE 40

Introduction QUIC in a Nutshell QUIC Packet Protection A Look at QUIC Draft 23 Implementations Conclusion and Perspectives

slide-41
SLIDE 41

QUIC Packet Protection

A Convoluted Procedure

Header Payload Encrypted Payload AEAD (AES-GCM) AES-ECB Sampling XOR (selected fields)

Packet Number

Masked Header Encrypted Payload Protected QUIC Packet

Associated Data Plaintext iv

Unprotected QUIC Packet

Nonce key Key header protection key

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 15 / 29

slide-42
SLIDE 42

QUIC Packet Protection

The Special Case of Initial Packets

Initial Packets are protected, but where do the keys come from? The initial secret is derived from ◮ a cleartext field in the Client Initial Packet

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 16 / 29

slide-43
SLIDE 43

QUIC Packet Protection

The Special Case of Initial Packets

Initial Packets are protected, but where do the keys come from? The initial secret is derived from ◮ a cleartext field in the Client Initial Packet ◮ a public value (the salt), depending on the protocol version

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 16 / 29

slide-44
SLIDE 44

QUIC Packet Protection

The Special Case of Initial Packets

Initial Packets are protected, but where do the keys come from? The initial secret is derived from ◮ a cleartext field in the Client Initial Packet ◮ a public value (the salt), depending on the protocol version Expected benefit from the WG (highly debatable) ◮ protection against off-path attackers ◮ robustness against QUIC version-unaware middleboxes

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 16 / 29

slide-45
SLIDE 45

QUIC Packet Protection

Header Protection Keys

Parts of the Header are also protected ◮ the hp key is derived from the initial secret ◮ a mask is generated using the encrypted payload as input ◮ the hp key stays the same during the whole connection

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 17 / 29

slide-46
SLIDE 46

QUIC Packet Protection

Header Protection Keys

Parts of the Header are also protected ◮ the hp key is derived from the initial secret ◮ a mask is generated using the encrypted payload as input ◮ the hp key stays the same during the whole connection Expected privacy benefit ◮ today, the only protected field is the Packet Number ◮ masking it should help provide unlinkability in case of address migration

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 17 / 29

slide-47
SLIDE 47

QUIC Packet Protection

Implementation of the Initial Exchange with Scapy (1/2)

Protecting a QUIC packet

  • 1. build the header from its fields
  • 2. build the payload from its fields
  • 3. pad the payload so the packet size is long enough
  • 4. report the payload length in the header to take the padding into

account

  • 5. derive secrets and IVs from the version and the DCID
  • 6. derive the nonce from the IV and the Packet Number
  • 7. encrypt the payload
  • 8. extract the sample
  • 9. encrypt the header
  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 18 / 29

slide-48
SLIDE 48

QUIC Packet Protection

Implementation of the Initial Exchange with Scapy (2/2)

The protection procedures mix three types of steps ◮ classical building/parsing steps ◮ cryptographic operations ◮ raw manipulations on the packet

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 19 / 29

slide-49
SLIDE 49

QUIC Packet Protection

Implementation of the Initial Exchange with Scapy (2/2)

The protection procedures mix three types of steps ◮ classical building/parsing steps ◮ cryptographic operations ◮ raw manipulations on the packet This complexity might lead to subtle bugs in corner cases ◮ the exact header/payload delimitation is lost during packet protection ◮ a variable length fields is updated after the initial building phase

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 19 / 29

slide-50
SLIDE 50

QUIC Packet Protection

Implementation of the Initial Exchange with Scapy (2/2)

The protection procedures mix three types of steps ◮ classical building/parsing steps ◮ cryptographic operations ◮ raw manipulations on the packet This complexity might lead to subtle bugs in corner cases ◮ the exact header/payload delimitation is lost during packet protection ◮ a variable length fields is updated after the initial building phase We believe this mechanism offers limited benefits (restricted attacker model, cooperating middleboxes) which does not justify the induced complexity

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 19 / 29

slide-51
SLIDE 51

Introduction QUIC in a Nutshell QUIC Packet Protection A Look at QUIC Draft 23 Implementations Conclusion and Perspectives

slide-52
SLIDE 52

A Look at QUIC Draft 23 Implementations

Test Servers

In the QUIC WG wiki, existing implementations are listed ◮ 16 different stacks are listed ◮ corresponding to 20 public servers We led measurement campaigns (related to different draft versions) ◮ several servers never answered any stimuli ◮ others had significant down times, especially after a new draft version ◮ around 10-12 seem to keep up with the latest draft

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 21 / 29

slide-53
SLIDE 53

A Look at QUIC Draft 23 Implementations

Test Servers

In the QUIC WG wiki, existing implementations are listed ◮ 16 different stacks are listed ◮ corresponding to 20 public servers We led measurement campaigns (related to different draft versions) ◮ several servers never answered any stimuli ◮ others had significant down times, especially after a new draft version ◮ around 10-12 seem to keep up with the latest draft Warning: the presented results are partial data on still evolving implementations

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 21 / 29

slide-54
SLIDE 54

A Look at QUIC Draft 23 Implementations

Version Negotiation

Stimuli

  • 1. a valid Initial Packet with a supported draft version
  • 2. packet 1 with a yet-to-be defined version
  • 3. a truncated version of packet 2

Expected result ◮ the first packet should be accepted ◮ the second and third packet should trigger a VersionNegotiation

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 22 / 29

slide-55
SLIDE 55

A Look at QUIC Draft 23 Implementations

Version Negotiation

Stimuli

  • 1. a valid Initial Packet with a supported draft version
  • 2. packet 1 with a yet-to-be defined version
  • 3. a truncated version of packet 2

Expected result ◮ the first packet should be accepted ◮ the second and third packet should trigger a VersionNegotiation Actual result Several servers choke on the third packet, which shows that they interpret the packet length field, although this field could be redefined in the future (cf. draft-quic-invariants)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 22 / 29

slide-56
SLIDE 56

A Look at QUIC Draft 23 Implementations

Client Initial Packet Length

To limit DoS amplification attacks, QUIC states that ◮ the Client Initial Packet should at least be 1,200 bytes long ◮ before the Handshake is complete, the server should not answer with more than 3 times the amount received

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 23 / 29

slide-57
SLIDE 57

A Look at QUIC Draft 23 Implementations

Client Initial Packet Length

To limit DoS amplification attacks, QUIC states that ◮ the Client Initial Packet should at least be 1,200 bytes long ◮ before the Handshake is complete, the server should not answer with more than 3 times the amount received Observations ◮ several servers accept 300-byte long stimuli ◮ but only answer with up to 900 bytes This is not ideal, nor dramatic.

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 23 / 29

slide-58
SLIDE 58

A Look at QUIC Draft 23 Implementations

Missing Parameters

The specification contains several requirements about TLS 1.3 extensions, including these ones ◮ ALPN is mandatory ◮ QUIC Transport Parameters must be sent

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 24 / 29

slide-59
SLIDE 59

A Look at QUIC Draft 23 Implementations

Missing Parameters

The specification contains several requirements about TLS 1.3 extensions, including these ones ◮ ALPN is mandatory ◮ QUIC Transport Parameters must be sent Deviations ◮ the sample packet in the draft does not conform to the requirements ◮ several implementations accommodate missing extensions ◮ one implementation only accepted our stimuli without ALPN

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 24 / 29

slide-60
SLIDE 60

A Look at QUIC Draft 23 Implementations

Frame Mangling

Initial Packets should only contain ◮ Crypto frames (and the ClientHello should not be split) ◮ ACKs ◮ Padding frames ◮ Connection Close messages However, several servers seem to accept

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 25 / 29

slide-61
SLIDE 61

A Look at QUIC Draft 23 Implementations

Frame Mangling

Initial Packets should only contain ◮ Crypto frames (and the ClientHello should not be split) ◮ ACKs ◮ Padding frames ◮ Connection Close messages However, several servers seem to accept ◮ Ping frames (allowed in draft-24)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 25 / 29

slide-62
SLIDE 62

A Look at QUIC Draft 23 Implementations

Frame Mangling

Initial Packets should only contain ◮ Crypto frames (and the ClientHello should not be split) ◮ ACKs ◮ Padding frames ◮ Connection Close messages However, several servers seem to accept ◮ Ping frames (allowed in draft-24) ◮ a ClientHello split into two frames (draft-24 allows spanning over several packets)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 25 / 29

slide-63
SLIDE 63

A Look at QUIC Draft 23 Implementations

Frame Mangling

Initial Packets should only contain ◮ Crypto frames (and the ClientHello should not be split) ◮ ACKs ◮ Padding frames ◮ Connection Close messages However, several servers seem to accept ◮ Ping frames (allowed in draft-24) ◮ a ClientHello split into two frames (draft-24 allows spanning over several packets) ◮ a Crypto frame split into two overlapping frames

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 25 / 29

slide-64
SLIDE 64

A Look at QUIC Draft 23 Implementations

Frame Mangling

Initial Packets should only contain ◮ Crypto frames (and the ClientHello should not be split) ◮ ACKs ◮ Padding frames ◮ Connection Close messages However, several servers seem to accept ◮ Ping frames (allowed in draft-24) ◮ a ClientHello split into two frames (draft-24 allows spanning over several packets) ◮ a Crypto frame split into two overlapping frames ◮ and even a Crypto frame inconsistently split!

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 25 / 29

slide-65
SLIDE 65

Introduction QUIC in a Nutshell QUIC Packet Protection A Look at QUIC Draft 23 Implementations Conclusion and Perspectives

slide-66
SLIDE 66

Conclusion and Perspectives

Conclusion

◮ QUIC is a protocol still under development ◮ It is worth studying, since it could become an important part of the web traffic ◮ It is a complex beast From the implementation point of view ◮ we wrote a first implementation of the protocol in Scapy ◮ we scanned public servers with corner case stimuli ◮ no server seems to conform to all the requirements we looked at ◮ however, these stacks are fast-evolving implementations of a moving target

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 27 / 29

slide-67
SLIDE 67

Conclusion and Perspectives

Future work

Regarding our Scapy implementation ◮ stabilize a version against the last drafts ◮ publish the code ◮ include other features (0 RTT, address migration)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 28 / 29

slide-68
SLIDE 68

Conclusion and Perspectives

Future work

Regarding our Scapy implementation ◮ stabilize a version against the last drafts ◮ publish the code ◮ include other features (0 RTT, address migration) Regarding the IETF WG and the ecosystem ◮ contribute to discussions on the WG list ◮ include our test suite in existing tools such as QUIC Tracker

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 28 / 29

slide-69
SLIDE 69

Conclusion and Perspectives

Future work

Regarding our Scapy implementation ◮ stabilize a version against the last drafts ◮ publish the code ◮ include other features (0 RTT, address migration) Regarding the IETF WG and the ecosystem ◮ contribute to discussions on the WG list ◮ include our test suite in existing tools such as QUIC Tracker Other (GASP) ideas ◮ try and implement QUIC specs with our tools ◮ fuzz the implementations (packets and state machines)

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 28 / 29

slide-70
SLIDE 70

Conclusion and Perspectives

Future work

Regarding our Scapy implementation ◮ stabilize a version against the last drafts ◮ publish the code ◮ include other features (0 RTT, address migration) Regarding the IETF WG and the ecosystem ◮ contribute to discussions on the WG list ◮ include our test suite in existing tools such as QUIC Tracker Other (GASP) ideas ◮ try and implement QUIC specs with our tools ◮ fuzz the implementations (packets and state machines) Possible collaborations (or internships) if you (or your students) are interested

  • E. Gagliardi, O. Levillain (TSP/MinArm)

QUIC Session Establishment 2020-05-29 28 / 29

slide-71
SLIDE 71

Questions?

Thank you for your attention @pictyeye

  • livier.levillain@telecom-sudparis.eu

https://paperstreet.picty.org/yeye