Multiplexed Application Substrate over QUIC Encryption (MASQUE)

Question 1

What are examples of proxies that exist?

Answer 1

• Native HTTP proxy: send HTTP GET to proxy, proxy makes request and forwards response.
• HTTP Connect: TCP connection via proxy, send HTTP Connect to proxy, proxy establishes TCP connection to remote server and forwards from then on.
• SOCKS: Support TCP/UDP, but very detectabe/ blockable(cleartext), also multiple RTT to establish connections.
• IPSec, transparent PEP, etc.

Question 2

What is the motivation behind MASQUE?

Answer 2

Many proxies exist, however HTTP/3 aka. QUIC breaks TCP- proxying technologies, since TLS encryptions is mandatory and it is built on UDP.
However QUIC also makes things easier, so we want to make it a basis for new type of proxy:
- Unreliable transmit
- Multiplexed streams
- HTTP/3 has all other required stuff: cache, auth, req/res

Question 3

What are some use cases for MASQUE?

Answer 3

• QUIC for encryption in VPN- like services
• QUIC for HTTP Connect
• DNS over HTTPS - via proxy
• Allowing Efficient tunneling of QUIC (with compression)

Question 4

What is the QUIC Datagram extension?

Answer 4

• It allows applications on top of QUIC to send unreliable data, while still leveraging sec. and cc properties of QUIC.
• Similar to DTLS (TLS for UDP)

Question 5

What is missing from QUIC Datagram extension in order for it to work with MASQUE?

Answer 5

• It can not demultiplex datagrams by default

- If QUIC is blocked, there is not fallback for earlier HTTP versions

Question 6

How does the draft by MASQUE WG solve the issues related to QUIC Datagram extension so that we can send datagrams with HTTP?

Answer 6

• Demultiplexing: Each datagram is associated with client- initiated bidirectional QUIC stream. Each stream identified by optional 62- bit context ID.
• Solving HTTP fallback: Simply send the data over TCP in this case, slower but works.
• Capsule Protocol: Sequence of type- length- value tuples allowing endpoints to reliably commmunicate request- related information. Has different types of capsules to register/close datagram connections.
• Connect UDP Method:
  HTTP datagrams from Client to Proxy, then UDP datagrams to Server.