PQ CRYPTA

Press Release

PQ Crypta Launches Enterprise HTTP/3 QUIC & WebTransport Scanner with 100+ Data Points

Today, PQ Crypta announces the release of its HTTP/3 QUIC & WebTransport Scanner—an enterprise-grade protocol analysis tool built on a native Rust QUIC stack that extracts over 100 data points per scan, identifies 50+ server implementations, and delivers ML-powered security recommendations in under 200 milliseconds.

The Challenge: Protocol Visibility in Modern Infrastructure

As HTTP/3 adoption accelerates (now supported by Cloudflare, Google, Facebook, Fastly, and major CDNs), organizations face a critical visibility gap. Traditional tools can't answer fundamental questions:

• Is our HTTP/3 actually accessible to browsers, or just configured?
• Are we vulnerable to 0-RTT replay attacks?
• What QUIC implementation is our CDN running?
• Do we support post-quantum hybrid key exchange?
• Is our WebTransport endpoint properly configured?

Browser DevTools show basic protocol information. Network analyzers require packet capture. Neither provides the deep metadata that security teams and performance engineers need.

The Solution: Native QUIC Deep Inspection

Unlike browser-based or curl-based scanners, PQ Crypta's scanner uses native Rust QUIC libraries (quinn, h3, rustls) to establish real QUIC connections and extract metadata directly from the protocol handshake.

5-Tier Grading System

The scanner introduces a security-focused grading system that distinguishes between server capability and browser accessibility:

This grading exposes a common misconfiguration: servers with HTTP/3 enabled on the origin but no Alt-Svc header, causing browsers to fall back to HTTP/2 despite server capability.

Comprehensive Metadata Extraction

Each scan extracts detailed metadata across eight categories:

QUIC Transport Parameters (18 fields)

Flow control limits, idle timeout, max UDP payload size, datagram frame support, connection migration settings, and GREASE bit configuration. These parameters reveal server tuning and implementation characteristics.

TLS Extensions (14 fields)

ALPN protocols, key share groups (including X25519MLKEM768 for post-quantum), signature algorithms, ECH support, certificate compression, and GREASE extension usage. Critical for security assessment.

Server Fingerprinting (5 fields)

Implementation identification using 3-tier detection: header analysis (95% confidence), domain analysis (85%), and transport parameter patterns (70%). Identifies Cloudflare, Google GFE, Facebook mvfst, nginx-quic, LiteSpeed, Caddy, Fastly, and 40+ more.

Connection Metrics (20 fields)

Handshake time, time-to-first-byte, RTT estimates, congestion window, packets sent/lost, loss rate percentage, path MTU discovery status, and congestion controller type (CUBIC, BBR, Reno).

Security Features (10 fields)

Retry packet usage, address validation, anti-amplification limits (3x standard), stateless reset support, and rate limiting detection.

HTTP/3 Settings (12 fields)

QPACK configuration, WebTransport enablement, DATAGRAM support, and RFC 9218 priority support.

HTTP/3 Headers (11 fields)

Alt-Svc, Server-Timing, Priority, Accept-CH client hints, NEL (Network Error Logging), Report-To, and 103 Early Hints detection.

WebTransport Capabilities (17 fields)

Session limits, stream types, datagram support, flow control, authentication requirements, and session establishment latency.

ML-Powered Recommendations

The scanner uses machine learning (RandomForest classifier with 100 trees) trained on historical scan data to provide contextual, actionable recommendations:

Recommendations include effectiveness scores and are filtered by context—no redundant advice for sites that already implement best practices.

Real-World Results

Analysis of 480+ scanned websites reveals:

The Grade C category represents a significant discovery: servers where operators believe HTTP/3 is working, but browsers silently fall back to HTTP/2 due to missing advertisement headers.

Try It Now

curl -X POST https://api.pqcrypta.com/http3-scanner/scan \
  -H "Content-Type: application/json" \
  -d '{"url": "https://cloudflare.com"}'

Technical Specifications

What's Next

The HTTP/3 scanner is part of PQ Crypta's broader mission to provide visibility into modern protocol adoption and post-quantum readiness. Upcoming features include:

• Bulk scanning API for enterprise infrastructure assessment
• Historical tracking and trend analysis
• Certificate chain analysis with PQC signature detection
• Integration with CI/CD pipelines for automated testing
• Webhook notifications for protocol changes