Skip to content

Commit c389b52

Browse files
committed
Add mitivation text per issue 32
1 parent f60a162 commit c389b52

File tree

1 file changed

+11
-3
lines changed

1 file changed

+11
-3
lines changed

draft-ietf-quic-address-discovery.md

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,13 +60,21 @@ by asking a remote server to report the observed source address. While the QUIC
6060
packets, moving address discovery into the QUIC layer has a number of
6161
advantages:
6262

63-
1. STUN traffic is unencrypted, and can be observed and modified by on-path
63+
1. STUN encryption relies on shared keys, which have to be provisioned.
64+
Absent such provisioning, STUN traffic is unencrypted
65+
QUIC provides encryption by default, using TLS 1.3.
66+
2. When unencrypted, STUN traffic can be observed and modified by on-path
6467
observers. By moving address discovery into QUIC's encrypted envelope it
6568
becomes invisible to observers.
66-
2. When located behind a load balancer, QUIC packets may be routed based on the
69+
3. STUN packet format is designed to facilitate multiplexing STUN and
70+
other protocols on the same IP address and port number (see {{?RFC7983}}).
71+
That property can be used by observers to detect use of STUN and infer
72+
use of peer-to-peer communications. In contrast, address discovery
73+
using QUIC does not "stick out".
74+
4. When located behind a load balancer, QUIC packets may be routed based on the
6775
QUIC connection ID. Depending on the architecture, not using STUN might
6876
simplify the routing logic.
69-
3. If QUIC traffic doesn't need to be demultiplexed from STUN traffic,
77+
5. If QUIC traffic doesn't need to be demultiplexed from STUN traffic,
7078
implementations can enable QUIC bit greasing ({{?RFC9287}}).
7179

7280
# Conventions and Definitions

0 commit comments

Comments
 (0)