Technical Advisory – Hash Denial-of-Service Attack in Multiple #QUIC Implementations

Technical Advisory – Hash Denial-of-Service Attack in Multiple #QUIC Implementations
A great blog post by my colleague, Paul Bottinelli, who discovered a hash denial-of-service attack in multiple QUIC implementations:
Go-msquic: A new QUIC/HTTP3 library for Go
Link: https://github.com/noboruma/go-msquic
Discussion: https://news.ycombinator.com/item?id=43098690
@nlnetlabs The build ain't as straightforward as we're used to. Why can't one just use #openssl with #ngtcp2 but instead need #quictls? I fear I sacrifice security by not using official OpenSSL libs for #quic
We have a canary build of our @nlnetlabs #unbound #docker image with #quic support available for testing, yay!
Let me explain the #OpenSSL #QUIC API move and what it might mean. For #curl and for others.
https://daniel.haxx.se/blog/2025/02/16/openssl-does-a-quic-api/
An #ngtcp2 lead developer told me they have no current plans to adapt to the new #OpenSSL #QUIC API because of its lack of 0RTT support and the "pull model".
Of course someone else can go ahead and write it and ideally someone from #OpenSSL does it, for dogfooding purposes.
I have no heard of any other QUIC stack either having adapted to it yet.
How to Enable QUIC.cloud CDN on Your cPanel Website Using CNAME (5-Minute Quick-Start Guide)
#cdn #litespeed #quic #quiccloud #Guides #Resellers #WebHosting
https://blog.radwebhosting.com/how-to-enable-quic-cloud-cdn-on-your-cpanel-website-using-cname-5-minute-quick-start-guide
New Post: How to Enable QUIC.cloud CDN on Your cPanel Website Using CNAME (5-Minute Quick-Start Guide)
#cdn #litespeed #quic #quiccloud #Guides #Resellers #WebHosting
https://blog.radwebhosting.com/how-to-enable-quic-cloud-cdn-on-your-cpanel-website-using-cname-5-minute-quick-start-guide
I asked the #OpenSSL team about their new #QUIC API:
Out of curiosity: since you decided to provide a quite different API than what was once offered to you and what several QUIC stacks are already using. How did you come up with this API?
https://github.com/openssl/openssl/pull/26683#issuecomment-2654928163
Good video about #quic protocol: https://www.youtube.com/watch?v=sULCOKfc87Y
#OpenSSL suddenly decided to provide an API for others to do #QUIC with it: https://github.com/openssl/openssl/pull/26683
Have you seen #QUIC Multipath support on our roadmap? We've been waiting so long for this ourselves, it will solve all our problems.
It is now *six* years ago since I first blogged about how the #QUIC API situation was going to slow down QUIC (and HTTP/3) deployment. Unfortunately I was entirely correct.
https://daniel.haxx.se/blog/2019/01/21/quic-and-missing-apis/
The follow-up post a few years later on OpenSSL's decision to be a laggard:
https://daniel.haxx.se/blog/2021/10/25/the-quic-api-openssl-will-not-provide/
TIL Network protocols Sans I/O
“… network protocol implementations written in Python that perform no I/O (this means libraries that operate directly on text or bytes; this excludes libraries that just abstract out I/O).”
Read the reference page
https://sans-io.readthedocs.io/
Iroh: Revolutionizing Peer-to-Peer Networking with QUIC and Hole-Punching
Iroh introduces a groundbreaking API for seamless peer-to-peer connections, leveraging QUIC for optimized data transfer. With its innovative hole-punching capabilities and a suite of pre-existing prot...
#OpenSSL #QUIC implementation performance is "abysmal" compared to competing solutions such as #ngtcp2 (ngtcp2 is 2-4x faster) and consumes tons (up to 25x in some situations) of memory. (*)
I still don't fathom why the OpenSSL project chose the path they took. It smells heavily of "Not Invented Here" to me.
Surely some future OpenSSL version will fix this mess?
*) https://lists.haxx.se/pipermail/daniel/2025-January/000096.html