The New, QUIC Based Encrypted Protocol Stack Taking over the Internet and How to Deal with It - BRKSPM-2024#

Andreas Enotiadis (Cisco), Bart Van de Velde (Cisco)

• Why: Adjacent rather than core because of its service-provider framing, but the QUIC/HTTP-3/DoH/ECH stack it describes is the same visibility threat covered in BRKSEC-3320, with protocol-internals depth.
• What: How the QUIC-based stack (QUIC + HTTP/3 + DoH + eSNI/ECH) is constructed and evolving — already claimed at ~50% of traffic and doubling every 18 months — and why it obsoletes the assumptions SP networks are built on: encryption kills application visibility, and congestion management moves into the application (from abstract only).
• How: Analysis of the stack's visibility and flow-control behavior plus SP-side countermeasures for traffic visibility, QoE monitoring, and efficient use of scarce resources like 5G spectrum.
• Where applicable: SP networks primarily; the protocol analysis applies to any operator of middleboxes and QoS infrastructure facing QUIC traffic.