Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WolfGuard: WireGuard with FIPS 140-3 cryptography

github.com

Post reply on HN
Print view View original

21–30 of 65 posts

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#21

Post by eptcyka »

LunaSea wrote: post #19
jmclnx wrote: post #17

Earlier quoted context omitted.

Yes, but be aware, openvpn is much better if you live in a Country like China, Russia and a few others. That is due to a known design issue with wireguard. For most people, wireguard is fine. Edit: I should have said "choice" instead of "issue", but Firefox 140 is failing on this site so I could not correct the txt. I was able to edit this after reverting back to Firefox 128.

Could you expand on the design flaw in question?

OpenVPN looks like a regular tls stream - difficult to distinguish between that and a HTTPS connection. WireGuard looks like WireGuard. But you can wrap WireGuard in whatever headers you might want to obfuscate it and the perf will still be better.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#23

Post by johnisgood »

alfanick wrote: post #9
LtWorf wrote: post #7

Earlier quoted context omitted.

but wolfssl is in the business of selling FIPS compliance so…

And they do it fast, thankfully Compliant Static Code Analyser catches issues like https://github.com/wolfSSL/wolfGuard/commit/fa21e06f26de201b...

Holy shit. Those are rookie mistakes[1], that could end up being SEVERE.

[1] Not referring to the fixes.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#24

Post by tptacek »

eptcyka wrote: post #21
LunaSea wrote: post #19

Earlier quoted context omitted.

Could you expand on the design flaw in question?

OpenVPN looks like a regular tls stream - difficult to distinguish between that and a HTTPS connection. WireGuard looks like WireGuard. But you can wrap WireGuard in whatever headers you might want to obfuscate it and the perf will still be better.

It's trivial to make WireGuard look like a regular TLS stream. It's probably not worth a 15 year regression in security characteristics just to get that attribute; just write the proxy for it and be done with it. It was a 1 day project for us (we learned the hard way that a double digit percentage of our users simply couldn't speak UDP and had to fix that).

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#25

Post by tptacek »

usui wrote: post #8

I know software developers complain about forced compliance due to the security theatre aspects, but I would like to charitably ask from someone who has technical understanding of FIPS-compliant cryptography. Are there any actual security advantages on technical grounds for making WireGuard FIPS-compliant? Assume the goal is not to appease pencil pushers. I really want to know if this kind of effort has technical gai…

No, there are not.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#26

Post by ongy »

usui wrote: post #8

I know software developers complain about forced compliance due to the security theatre aspects, but I would like to charitably ask from someone who has technical understanding of FIPS-compliant cryptography. Are there any actual security advantages on technical grounds for making WireGuard FIPS-compliant? Assume the goal is not to appease pencil pushers. I really want to know if this kind of effort has technical gai…

Crypto wise, fips is outdated but not horrible.

Actual fips compliant (certified) gives you confidence in some basic competence of the solution.

Just fips compatible (i.e. picking algos that could be fips compliant) is generally neutral to negative.

I'm not 100% up to date, so that might have changed, but AEAD used to be easier if you don't follow fips than fips compatible. Still possible, but more foot guns due to regulatory lag in techniques.

Overall, IMO the other top-level comment of "only fips if you have pencil pusher benefit" applies.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#27

Post by IncRnd »

usui wrote: post #8

I know software developers complain about forced compliance due to the security theatre aspects, but I would like to charitably ask from someone who has technical understanding of FIPS-compliant cryptography. Are there any actual security advantages on technical grounds for making WireGuard FIPS-compliant? Assume the goal is not to appease pencil pushers. I really want to know if this kind of effort has technical gai…

If you're considering whether to use a FIPS 140-3 module for your cryptography, consider that FIPS 140-3 is really only for specific compliance verticals. If you don't know whether you need it, you probably don't need it.

So, along those lines, if you wonder whether a package's cryptography should be FIPS 140-3 compliant, then the real question is whether you are a vertical that needs to be compliant. Again, if you aren't sure, the answer is likely NO.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#28

Post by gruez »

eptcyka wrote: post #21
LunaSea wrote: post #19

Earlier quoted context omitted.

Could you expand on the design flaw in question?

OpenVPN looks like a regular tls stream - difficult to distinguish between that and a HTTPS connection. WireGuard looks like WireGuard. But you can wrap WireGuard in whatever headers you might want to obfuscate it and the perf will still be better.

>OpenVPN looks like a regular tls stream - difficult to distinguish between that and a HTTPS connection.

I thought openvpn had some weird wrapper on top of TLS that makes it easily detectable? Also to bypass state of the art firewalls (eg. China's gfw), it's not sufficient to be just "tls". Doing TLS-in-TLS produces telltale statistical signatures that are easily detectable, so even simpler protocols like http CONNECT proxy over TLS can be detected.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#29

Post by eptcyka »

tptacek wrote: post #24
eptcyka wrote: post #21

Earlier quoted context omitted.

OpenVPN looks like a regular tls stream - difficult to distinguish between that and a HTTPS connection. WireGuard looks like WireGuard. But you can wrap WireGuard in whatever headers you might want to obfuscate it and the perf will still be better.

It's trivial to make WireGuard look like a regular TLS stream. It's probably not worth a 15 year regression in security characteristics just to get that attribute; just write the proxy for it and be done with it. It was a 1 day project for us (we learned the hard way that a double digit percentage of our users simply couldn't speak UDP and had to fix that).

It is, we did the same. It is a shame that only Linux supports proper fake TCP though.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#30

Post by coppsilgold »

eptcyka wrote: post #29
tptacek wrote: post #24

Earlier quoted context omitted.

It's trivial to make WireGuard look like a regular TLS stream. It's probably not worth a 15 year regression in security characteristics just to get that attribute; just write the proxy for it and be done with it. It was a 1 day project for us (we learned the hard way that a double digit percentage of our users simply couldn't speak UDP and had to fix that).

It is, we did the same. It is a shame that only Linux supports proper fake TCP though.

Doesn't the Chinese firewall perform sophisticated filtering? Fake TCP should not be difficult to catch. I recall reading how the firewall uses proxies to initiate connections just to see whats up.
Post reply on HN