QUIC is a new network protocol standardized in 2021. It was designed to replace the TCP/TLS stack and is based on UDP. The most current web standard HTTP/3 is specifically designed to use QUIC as transport protocol. QUIC claims to provide secure and fast transport with low-latency connection establishment, flow and congestion control, reliable delivery, and stream multiplexing. To achieve the security goals, QUIC enforces the usage of TLS 1.3. It uses authenticated encryption with additional data (AEAD) algorithms to not only protect the payload but also parts of the header. The handshake relies on asymmetric cryptography, which will be broken with the introduction of powerful quantum computers, making the use of post-quantum cryptography inevitable. This paper presents a detailed evaluation of the impact of cryptography on QUIC performance. The high-performance QUIC implementations LSQUIC, quiche, and MsQuic are evaluated under different aspects. We break symmetric cryptography down to the different security features. To be able to isolate the impact of cryptography, we implemented a NOOP AEAD algorithm which leaves plaintext unaltered. We show that QUIC performance increases by 10 to 20% when removing packet protection. The header protection has negligible impact on performance, especially for AES ciphers. We integrate post-quantum cryptographic algorithms into QUIC, demonstrating its feasibility without major changes to the QUIC libraries by using a TLS library that implements post-quantum algorithms. Kyber, Dilithium, and FALCON are promising candidates for post-quantum secure QUIC, as they have a low impact on the handshake duration. Algorithms like SPHINCS+ with larger key sizes or more complex calculations significantly impact the handshake duration and cause additional issues in our measurements.

翻译：QUIC是2021年标准化的新型网络协议，旨在替代TCP/TLS协议栈，其基于UDP构建。当前最新的Web标准HTTP/3特别设计采用QUIC作为传输协议。QUIC宣称能够提供安全、快速的传输服务，具有低延迟连接建立、流量与拥塞控制、可靠交付及流复用等特性。为实现安全目标，QUIC强制使用TLS 1.3协议，并采用带关联数据的认证加密（AEAD）算法，不仅保护负载数据，还部分保护报文头。其握手过程依赖于非对称密码学，而强大量子计算机的出现将突破此类密码体系，使得后量子密码学的应用成为必然。本文对密码学对QUIC性能的影响进行了详细评估。我们从多维度评估了LSQUIC、quiche和MsQuic等高性能QUIC实现方案，并将对称密码学分解到不同安全特性层面进行分析。为隔离密码学性能影响，我们实现了保留明文不变的NOOP AEAD算法。研究表明，移除数据包保护后QUIC性能提升10%至20%。报文头保护对性能影响甚微，尤其在使用AES密码套件时更为显著。我们将后量子密码算法集成至QUIC系统，验证了通过采用实现后量子算法的TLS库即可实现集成，无需对QUIC库进行重大改动。Kyber、Dilithium和FALCON作为后量子安全QUIC的候选方案具有显著优势，它们对握手时长影响较小。而SPHINCS+等密钥尺寸更大或计算复杂度更高的算法会显著延长握手时长，并在我们的测量中引发额外问题。