6

Recently, I notice that while using Google search, I am connecting to Google's server using UDP instead of TCP on both port 80 and port 443. It seems that Google is experimenting with some new technology related to SPDY QUIC or HTTP/2.0.

Since UDP is a connectionless protocol, it can be spoofed easily. Does this not make HTTPS over UDP insecure?

  • Yes, it's QUIC, and relies on the transport being connectionless for some of its features. – grawity Dec 15 '14 at 8:49
8

HTTPS over UDP is secure. This is because the security of HTTPS doesn't use any of the properties of TCP except that it is a transport layer. Just like UDP, TCP is easy to spoof and manipulate. TCP is only to make things more reliable, not more secure. With UDP, packets can be doubled, missed or sent in the wrong order. TLS is a means to fix these issues. TLS works on UDP instead of TCP. But then those issues would make the encryption more likely to break on one side, and the connection would fail.

If you start to add error correction and other features to higher protocols like TLS, you basically re-build TCP, which is bad as then you have to maintain (and build) your own TCP stack with all the problems this introduces.

The UDP connections you are observing are most likely not SDP, as SDP uses TCP for transport.

  • 3
    note: TLS over UDP is 'well defined' as DTLS (datagram TLS). I have submitted an edit to include this in your comment, and to change what looked like a couple typos saying TLS instead of TCP when comparing transport protocols to UDP. Please correct (if edit is accepted) if I mistakenly changed your intent. – atk Dec 14 '14 at 5:49
  • Thanks. Can I say that reliability of a connection does not affect its security at all? – Question Overflow Dec 14 '14 at 12:23
  • 1
    @QuestionOverflow technically, reliability is related to security. For example, if the server is not reliably accessible, then it's DOS. However, UDP turns out to be surprisingly reliable and the impact upon reliability is likely to be so small that it is acceptable, – atk Dec 14 '14 at 13:24
  • 3
    What if re-building TCP is the explicit intention? – grawity Dec 15 '14 at 8:51
  • But what if only very small data transfer is needed? In this case, an udp packet interchange could be much more efficient, especially if there is no security concern or it is protected with tls. – peterh Dec 15 '14 at 18:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.