Re: Add application parameters to QUIC handshake and use it for H3 SETTINGS

[Christian Huitema <[e-mail]>]

On 9/26/2019 2:51 PM, Nick Harper wrote:

> I propose introducing application parameters to the QUIC handshake and
> using this new mechanism for H3 SETTINGS instead of sending them as
> the first thing in the control stream. Application parameters would
> allow applications using QUIC to advertise or negotiate
> application-specific parameters during the cryptographic and transport
> handshake. It would guarantee that the client and server have
> exchanged their application parameters once the handshake is complete.
>
> Specifically, I’m proposing a new “application_layer_parameters”
> transport parameter, which when sent by the client is a series of ALPN
> identifiers with an opaque blob of application parameters per
> identifier, and when sent by the server is a single opaque blob of
> application parameters for the application identified in the ALPN
> extension.


I am a tad concerned with the privacy aspects of this proposal, at least
on the client side. Currently, the settings frame is sent encrypted in
0-RTT or 1-RTT packets. With your proposal, it would be sent in
clear-text, allowing very easy fingerprinting of clients.

-- Christian Huitema