While the industry was still absorbing the HTTP/2 Rapid Reset lesson, the next protocol-level war had already begun. HTTP/3 over QUIC (RFC 9000, standardized 2021) is now mainstream—QUIC exceeds half of traffic at Cloudflare, Google, and Meta. But QUIC swaps TCP for UDP, bringing performance gains and reopening a whole new DDoS attack surface. From a defender's view, here is why QUIC makes L7 protection harder.

1. Why QUIC changes the rules

QUIC's core design choices dictate its security properties:

  • UDP-based: bypasses middlebox (firewall/NAT/IDS) assumptions about TCP, and inherits UDP's connectionless nature (see the reflection piece).
  • Encrypted by default: the handshake (Initial) packet is encrypted; middleboxes can no longer peek at flags like they did with TCP—plaintext-feature filtering breaks.
  • Userspace implementation: QUIC often runs in user space (nginx/quiche, envoy); every packet costs expensive crypto instead of the kernel's TCP stack.

2. Crypto-cost asymmetry: a QUIC-flavored Rapid Reset?

Rapid Reset's essence was "attacker pays little, server pays enormously" computational asymmetry. QUIC's handshake has a similar lever:

Every QUIC Initial packet forces the server to do key derivation, decryption, and state allocation. An attacker firing many spoofed/empty handshakes exhausts server CPU before any meaningful connection is established.

This is exactly why RFC 9000 requires servers to carry a Token in the Retry packet—"prove you're real first" to block spoofed-source handshake floods. But the token mechanism itself introduces new edge cost that defenders must implement correctly.

3. QUIC amplification: small request, large response

Research by NCC Group and Cloudflare (2022–2023) showed a QUIC server's first response (Retry or Handshake) can be larger than the client's Initial, yielding a ~3–5× amplification factor. Far smaller than Memcached's 51k×, but combined with source spoofing it still pressures servers and reflectors. RFC 9000 requires Retry tokens to suppress amplification, yet incompletely implemented servers remain a risk.

4. 0-RTT replay: the underrated weapon

QUIC's 0-RTT lets a client send data before the handshake completes (lower latency). But 0-RTT data can be replayed—an attacker captures a 0-RTT packet and replays it repeatedly, launching amplification + replay DDoS at the origin/app without establishing connections. Defenders must make 0-RTT idempotent/one-time and restrict it to safe methods (GET).

5. Connection migration and CID abuse

QUIC's connection migration (resume via Connection ID across networks) and stateless reset are conveniences and attack surface:

  • CID prediction/race: predictable CID generation lets attackers forge reset packets to tear down masses of connections.
  • Migration abuse: repeatedly triggering migration forces the server to rebuild state, burning resources.
  • Version-negotiation flood: sending many unknown-version packets forces server-side version-negotiation handling.

6. The defender's QUIC survival checklist

  • QUIC-aware edge protection: don't rely on TCP features; rate-limit at the UDP/QUIC layer—per-connection limits, handshake-frequency caps, strict Retry-token validation.
  • Contain the crypto-cost asymmetry: early-drop Initial packets lacking a valid token; do handshake crypto at the edge, not the origin.
  • Constrain 0-RTT: allow only idempotent methods, enable replay protection (nonce/one-time token).
  • Monitor protocol metrics: track "incomplete handshakes / established connections", Retry frequency, 0-RTT ratio—these are early QUIC-attack signals.
  • Same lesson as Rapid Reset: an architecture that spots frame-level anomalies and mitigates in seconds is the real barrier against QUIC-era attacks.

Conclusion

QUIC/HTTP3 isn't "more secure"—it moves the security boundary from the network core to the protocol edge. It removes plaintext visibility while amplifying crypto cost—a structural challenge to packet-level filtering. Rapid Reset taught lesson one: attackers chase every new protocol's cost asymmetry. In the QUIC era, defenders must have frame-level detection and automated mitigation at the protocol edge, or the next "398M RPS" may well run over UDP.