Steganography in the QUIC Communication Protocol

JUCS - Journal of Universal Computer Science 32(2): 181-208, doi: 10.3897/jucs.154672

Aleksandar Velinov^‡, Aleksandra Mileva^‡, Simon Volpert^§, Sebastian Zillien^§, Steffen Wendzel^§

‡ Goce Delcev University, Stip, Republic of North Macedonia§ Ulm University, Ulm, Germany

Corresponding author: Aleksandra Mileva ( aleksandra.mileva@ugd.edu.mk )

This is an open access article distributed under the terms of the Creative Commons Attribution License (CC BY 4.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.

Citation: Velinov A, Mileva A, Volpert S, Zillien S, Wendzel S (2026) Steganography in the QUIC Communication Protocol. JUCS - Journal of Universal Computer Science 32(2): 181-208. https://doi.org/10.3897/jucs.154672

Abstract

Network steganography has existed for several decades and it uses network traffic and network protocols as carriers for embedding secret messages in a stealthy manner. Quick UDP Internet Connections (QUIC) is a novel secure and reliable transport layer network protocol that is encapsulated in the User Datagram Protocol (UDP) and utilizes the Transport Layer Security Version 1.3 (TLSv1.3) standard. In addition, Hypertext Transfer Protocol Version 3 (HTTP/3) employs QUIC. In this paper, we present a systematic analysis of the covert channels that can be found in QUIC. Twenty novel covert channels are identified by applying the latest covert channel pattern based taxonomy, and an analysis of their transmission rate, undetectability, and robustness is presented, together with suggested countermeasures. A single covert channel is implemented as a proof of concept tool and is appropriately evaluated.

Keywords

Network steganography, covert channels, QUIC, UDP, HTTP/3