Kwik is a pure Java implementation of the QUIC transport protocol (RFC 9000, RFC 9001, RFC 9369) supporting versions 1 and 2, along with extensions for unreliable datagrams (RFC 9221) and reliable stream reset. It provides both client and server APIs, with a modular architecture consisting of core protocol engine, CLI tool, HTTP/0.9 support, qlog structured logging, and interoperability test harness. The library is designed for embedding in Java applications needing low-latency, multiplexed, encrypted network connections. It includes a custom TLS 1.3 engine (agent15) for handshake management and leverages Java's module system. Extensive unit tests and interop testing against other QUIC implementations ensure protocol compliance. The codebase demonstrates strong engineering practices with clean abstractions (filter chains, builder patterns, null objects), though some features like server connection migration and stream priority remain incomplete.
XQUIC is a production-grade C implementation of the QUIC transport protocol (RFC 9000) and HTTP/3 (RFC 9114), developed by Alibaba. It provides a full-featured QUIC stack including connection management, packet encryption, loss detection, congestion control (BBR, CUBIC, NewReno, Copa), and HTTP/3 with QPACK header compression. The library also supports experimental extensions such as Multipath QUIC, Forward Error Correction (FEC), and Media over QUIC (MoQ) for streaming media. The architecture is modular with a callback-driven engine, pluggable congestion control and TLS backends (BoringSSL, BabaSSL), and extensive testing infrastructure including unit tests (CUnit), integration shell scripts, and interoperability tests. The codebase is well-structured with reusable utility components (ring buffers, hash tables, object pools, timer managers) and demonstrates strong software engineering practices, though the large number of feature flags and experimental extensions introduce some complexity and potential drift.
cloudflare/tls-tris is a Go library that extends the standard library's crypto/tls package with experimental TLS 1.3 support, post-quantum key exchange (SIDH, SIKE, and hybrids), delegated credentials, and 0-RTT. It is not a standalone package; it replaces the Go standard library's crypto/tls via a patched GOROOT. The library implements full client and server TLS 1.3 handshakes, record layer processing, session ticketing, and provides APIs consistent with the standard Go tls package (tls.Config, tls.Conn, tls.Dial). The codebase is derived from Go 1.10-era crypto/tls with extensive modifications. It includes integration with Cloudflare's SIDH library for post-quantum cryptography and supports hybrid key exchange combining X25519 with SIDH or SIKE. The repository contains comprehensive test infrastructure including golden test data files, BoringSSL test suite runner (bogo), Docker-based interop testing against other TLS implementations (NSS, picotls, mint), and Caddy integration examples. However, the TLS 1.3 implementation is based on early IETF drafts (draft-18, -21, -22, -28) and is not compliant with the final RFC 8446. The post-quantum algorithms SIDH and SIKE have been broken by the Castryck-Decru attack; this code is cryptographically obsolete. The library requires a custom Go toolchain (patched from Go 1.10) and cannot be vendored or used as a standard Go module, making it incompatible with modern Go development workflows.