WolfGuard: WireGuard with FIPS 140-3 cryptography
1–10 of 65 posts
Re: WolfGuard: WireGuard with FIPS 140-3 cryptography
#2The conventional wisdom in cryptography is that if you don't know you need FIPS, if you don't have paper and a dollar figure telling you how much you need it, you don't need or want FIPS.
Re: WolfGuard: WireGuard with FIPS 140-3 cryptography
#3Wireguard exemplifies the superiority of a qualified independent developer over the fractal layers of ossified cruft that you get from industry efforts and compliance STIGS.
So it feels wrong to see wireguard adapted for compliance purposes. If compliance orgs want superior technology, let their standards bodies approve/adopt wireguard without modifying it.
Re: WolfGuard: WireGuard with FIPS 140-3 cryptography
#4Can't you also get FIPS 140-3 WireGuard by compiling wireguard-go with the new native FIPS support in Go?
Re: WolfGuard: WireGuard with FIPS 140-3 cryptography
#5Can't you also get FIPS 140-3 WireGuard by compiling wireguard-go with the new native FIPS support in Go?
The ciphers used by WireGuard are not FIPS 140-3 certified. So you have to also change the ciphers, as is done in this project.
Re: WolfGuard: WireGuard with FIPS 140-3 cryptography
#6So a step backward in security ?
Re: WolfGuard: WireGuard with FIPS 140-3 cryptography
#7Wireguard exemplifies the superiority of a qualified independent developer over the fractal layers of ossified cruft that you get from industry efforts and compliance STIGS. So it feels wrong to see wireguard adapted for compliance purposes. If compliance orgs want superior technology, let their standards bodies approve/adopt wireguard without modifying it.
but wolfssl is in the business of selling FIPS compliance so…
Re: WolfGuard: WireGuard with FIPS 140-3 cryptography
#8I know software developers complain about forced compliance due to the security theatre aspects, but I would like to charitably ask from someone who has technical understanding of FIPS-compliant cryptography. Are there any actual security advantages on technical grounds for making WireGuard FIPS-compliant? Assume the goal is not to appease pencil pushers. I really want to know if this kind of effort has technical gains.
Re: WolfGuard: WireGuard with FIPS 140-3 cryptography
#9Wireguard exemplifies the superiority of a qualified independent developer over the fractal layers of ossified cruft that you get from industry efforts and compliance STIGS. So it feels wrong to see wireguard adapted for compliance purposes. If compliance orgs want superior technology, let their standards bodies approve/adopt wireguard without modifying it.
but wolfssl is in the business of selling FIPS compliance so…
And they do it fast, thankfully Compliant Static Code Analyser catches issues like https://github.com/wolfSSL/wolfGuard/commit/fa21e06f26de201b...
Re: WolfGuard: WireGuard with FIPS 140-3 cryptography
#10I know software developers complain about forced compliance due to the security theatre aspects, but I would like to charitably ask from someone who has technical understanding of FIPS-compliant cryptography. Are there any actual security advantages on technical grounds for making WireGuard FIPS-compliant? Assume the goal is not to appease pencil pushers. I really want to know if this kind of effort has technical gai…
I presume it's a product strategy to provide a box of "compliant" libraries/services, so other companies can quickly tick and sign a checkbox saying "we use compliant VPN", because someone else is going to look whether the checkbox is ticked and signed, because someone else is going to...