WebTransport with Certificate Hashes

[lidel]

tl;dr

• WebTransport can act as a replacement for Secure WebSockets (/wss) that is easier to set up thanks to "certificate hashes" feature which might provide means to remove the need for getting TLS cert from some CA
• Limited to Chromium-based browsers now (Firefox wip but not ETA, Safari plans tbd)

Status

• 2024-Q1:
  • Too many pending WebTransport sessions in Chromium  #211
  • WPT tests are needed for serverCertificateHash feature w3c/webtransport#589
• 2022-Q1:
  • The WebTransport protocol is currently under development at the IETF.
  • Chrome has implemented and shipped support for draft-02
  • Chrome v100 supports serverCertificateHashes option
  • libp2p team is looking into "certificate hashes", internal evaluation (libp2p notes)

    • The most exciting feature for us (other than the improved performance and hole punching success rates that QUIC gives us) is that the W3C added a browser API allowing browsers to establish connections to nodes with self-signed certificates, provided they know the hash of the certificate in advance: serverCertificateHashes. Even more exciting, this is already implemented in Chrome and will ship with version 100.

Reading

• https://web.dev/webtransport/
• https://w3c.github.io/webtransport/
• https://github.com/w3c/webtransport/blob/main/explainer.md
• serverCertificateHashes option
  • https://chromestatus.com/feature/5690646332440576
  • https://w3c.github.io/webtransport/#dom-webtransportoptions-servercertificatehashes
  • https://groups.google.com/a/chromium.org/g/blink-dev/c/m0v9XiwKA4M
• https://www.notion.so/pl-strflt/Enabling-WebTransport-across-the-libp2p-network-c6849c7252a1469a828a6c3e4b6abcad
• Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=1692754

[lidel]

WebTransport for libp2p is discussed in libp2p/specs#404 🚀