What's QUIC?

Microsoft

Nov 17, 2022

HotCakeX QUIC works differently than traditional TLS over TCP. QUIC is more akin to SMB or NFS, in that you send commands (called frames in QUIC) inside of either a long or short packet (not to be mistaken with an Ethernet frame that is often called a packet).

The Initial packets carry the key exchange, the Handshake packets handle the TLS exchange. The Initial is not protected (unencrypted) and the Handshake packet is protected (encrypted) using the keys from the Initial packets. Inside the Initial and Handshake packets are CRYPTO frames which perform the key exchange and TLS handshake.

SNI works in QUIC as part of http/3. The names should be encrypted inside the Handshake/CRYPTO packets. The Initial packets are the only unencrypted packets in QUIC 1.0, as I recall.

17.2.2. Initial Packet

   An Initial packet uses long headers with a type value of 0x00. It
   carries the first CRYPTO frames sent by the client and server to
   perform key exchange, and it carries ACK frames in either direction.

https://datatracker.ietf.org/doc/html/rfc9000#section-17.2.2

17.2.4. Handshake Packet

A Handshake packet uses long headers with a type value of 0x02,

followed by the Length and Packet Number fields; see Section 17.2.

The first byte contains the Reserved and Packet Number Length bits;

see Section 17.2. It is used to carry cryptographic handshake

messages and acknowledgments from the server and client.

https://datatracker.ietf.org/doc/html/rfc9000#section-17.2.4

19.6. CRYPTO Frames

A CRYPTO frame (type=0x06) is used to transmit cryptographic

handshake messages. It can be sent in all packet types except 0-RTT.

The CRYPTO frame offers the cryptographic protocol an in-order stream