search

httpwg / http-core

Core HTTP Specifications
https://httpwg.org/http-core/
467 stars 43 forks source link

QUIC and https:// #194

Closed martinthomson closed 5 years ago

martinthomson commented 5 years ago

Is it possible that an https:// URI might be used to directly initiate an HTTP/3 connection?

This is a tricky and nuanced question, that I think HTTP recognizes as a possibility in its current definition of the scheme, however, I would like this to be much clearer. The text implicitly only blesses TLS and TCP port 443 as a valid destination.

Ensuring that this is more direct might be hard without buttoning this down too tightly. It might be possible to offer examples of valid options that also includes QUIC.

mnot commented 5 years ago

Discussed in Montreal; create two new issues as per above and close.

vrubleg commented 5 years ago

@mnot, could you please write here briefly what is the outcome of the discussion and which issues should be created? =)

MikeBishop commented 5 years ago

it doesn't actually seem to me QUIC is really the same thing as a transport like TCP (or TLS, for that matter, which is essentially TCP with privacy and authentication).

TCP is a transport. TLS is not a transport; it's an encryption and authentication layer which is often, but need not be, carried over TCP. UDP is a multiplexing protocol that leaves transport functionality to higher layers. QUIC implements TCP-like transport services on top of UDP, integrating TLS to provide encryption and authentication services.

In short-hand, though, QUIC is an encrypted and authenticated transport.