RE: Questions on HTTP URI schemes and QUIC

[Sridhar Bhaskaran <[e-mail]>]

Hi Lucas,

>> Are the required transformations shareable (or captured in some 3GPP document). We are aware of a congestion control use case but additional ones are welcome.

The draft change requests are currently being discussed between 3GPP SA3 and CT4. You will see the updated specs once this is agreed - after September. The latest draft CR is available @ http://www.3gpp.org/ftp/tsg_sa/WG3_Security/TSGS3_91Bis_LaJolla/Docs/S3-181937.zip. Note that this draft CR is for 3GPP release 15 where the transport is TCP/TLS. My questions below are for the study item in 3GPP release 16 where we are exploring if QUIC can be used as an alternate transport.

>> However, considering the model I have for tunnelling QUIC, the amount of in-the-loop processing possible is likely to be minimal due to the end-to-end QUIC security context. The proxy will have access to IP, UDP and QUIC headers but not QUIC protected payload.

Yes this is understood. One follow up question is - can a bump in TLS (TLS interception) where a proxy provides certificates on behalf of origin host signed by its own CA (provided the client is configured to trust this CA) work with QUIC? Can this be made to work to intercept the protected payload at a proxy?

Thanks
Sridhar
-----Original Message-----
From: Lucas Pardue [mailto:[e-mail]] 
Sent: Friday, July 20, 2018 1:06 AM
To: Sridhar Bhaskaran <[e-mail]>; IETF QUIC WG <[e-mail]>
Subject: RE: Questions on HTTP URI schemes and QUIC

Hi Sridhar,

Thanks for sharing the 3GPP work.

Sridhar wrote:

>Note that this SEPP is not a blind forwarding proxy. It does message 
>transformations based on operator policies. So as highlighted in slide 
>8 SEPP's role is "in the loop".

Are the required transformations shareable (or captured in some 3GPP document). We are aware of a congestion control use case but additional ones are welcome.

However, considering the model I have for tunnelling QUIC, the amount of in-the-loop processing possible is likely to be minimal due to the end-to-end QUIC security context. The proxy will have access to IP, UDP and QUIC headers but not QUIC protected payload.

Kind regards
Lucas