QUIC
UDP-Based Multiplexed and Secure TransportQUIC is a fresh take on transport. It rebuilds TCP’s reliability on top of UDP, folds TLS 1.3 encryption into the handshake, and carries many independent streams at once — so one lost packet no longer stalls all the others. It is the transport under HTTP/3.
QUIC gives TCP’s reliability without TCP’s connection-wide head-of-line blocking — encrypted by default and fast to connect.
How it works
Transport + TLS handshake combine, so data flows after a single round trip.
A returning client can send data in the very first packet.
Identify a connection by ID, not IP:port — so it survives a network change.
Because QUIC lives in user space over UDP, browsers ship changes without waiting on the OS — and a phone moving from Wi-Fi to cellular keeps the same connection by its Connection ID.
What QUIC does, step by step
The transport and TLS 1.3 handshakes merge into one exchange — there is no unencrypted QUIC.
Each request gets its own stream, delivered and flow-controlled independently of the others.
Loss delays the stream data carried in the missing packet, while unaffected streams can keep progressing; loss detection and congestion control live in QUIC itself.
A Connection ID lets the session follow the client across a new IP — no reconnect, no dropped download.
In cybersecurity
Encrypting the transport itself is a privacy win — but it also blinds the middleboxes that used to inspect traffic, moving the security battle to the endpoints.
Nearly everything but a little routing metadata is protected — no passive on-path snooping.
Firewalls and IDS that parsed TCP now see opaque UDP — visibility must move onto the host.
Early data can be replayed by an attacker, so it must be restricted to safe, idempotent requests.
A Retry token forces address validation before the server commits work to a new client.
Networks that throttle UDP 443 force a fall back to TCP — clients keep a TLS/TCP path ready.
Living in the app means fixes ship on the release cadence, not a slow OS kernel update.