@@ -60,13 +60,21 @@ by asking a remote server to report the observed source address. While the QUIC
6060packets, moving address discovery into the QUIC layer has a number of 
6161advantages :
6262
63- 1. STUN traffic is unencrypted, and can be observed and modified by on-path 
63+ 1. STUN encryption relies on shared keys, which have to be provisioned. 
64+    Absent such provisioning, STUN traffic is unencrypted 
65+    QUIC provides encryption by default, using TLS 1.3.  
66+ 2. When unencrypted, STUN traffic can be observed and modified by on-path 
6467   observers. By moving address discovery into QUIC's encrypted envelope it 
6568   becomes invisible to observers. 
66- 2. When located behind a load balancer, QUIC packets may be routed based on the 
69+ 3. STUN packet format is designed to facilitate multiplexing STUN and 
70+    other protocols on the same IP address and port number (see {{?RFC7983}}). 
71+    That property can be used by observers to detect use of STUN and infer 
72+    use of peer-to-peer communications. In contrast, address discovery 
73+    using QUIC does not "stick out". 
74+ 4. When located behind a load balancer, QUIC packets may be routed based on the 
6775   QUIC connection ID. Depending on the architecture, not using STUN might 
6876   simplify the routing logic. 
69- 3 . If QUIC traffic doesn't need to be demultiplexed from STUN traffic,
77+ 5 . If QUIC traffic doesn't need to be demultiplexed from STUN traffic,
7078   implementations can enable QUIC bit greasing ({{?RFC9287}}). 
7179
7280#  Conventions and Definitions
0 commit comments