Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WolfGuard: WireGuard with FIPS 140-3 cryptography

github.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#41

Post by cyberax »

eptcyka wrote: post #21
LunaSea wrote: post #19

Earlier quoted context omitted.

Could you expand on the design flaw in question?

OpenVPN looks like a regular tls stream - difficult to distinguish between that and a HTTPS connection. WireGuard looks like WireGuard. But you can wrap WireGuard in whatever headers you might want to obfuscate it and the perf will still be better.

Raw OpenVPN is very easy to distinguish, its handshake signature is very different from the regular TLS.

OpenVPN is fine if you want to tunnel through a hotel network that blocks UDP, but it's useless if you want to defeat the Great China Firewall or similar blocks.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#43

Post by jandrese »

AaronFriel wrote: post #2

The conventional wisdom in cryptography is that if you don't know you need FIPS, if you don't have paper and a dollar figure telling you how much you need it, you don't need or want FIPS.

FIPS just locks you into a specific (generally fairly old) version of everything and sets some more annoying defaults. The only benefit is to be able to check a box on a form saying you qualify.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#44

Post by tptacek »

coppsilgold wrote: post #34

It's unfortunate that WireGuard doesn't include a switch that if both sides agree the crypto in use would be AES and SHA256. Not due to FIPS compliance but performance and power savings. I never once used WireGuard on hardware that didn't have AES and SHA intrinsics, all that battery wasted.

A core part of the security design of WireGuard is not negotiating cryptography.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#45

Post by tptacek »

cookiengineer wrote: post #40

> XChaCha20-Poly1305 replaced with AES-256-GCM What could possibly go wrong? It's not like every CTF ever designed has a block cipher or counter mode challenge. /s If the project wasn't done by WolfSSL, I would have assumed it's a trolling attempt to mock FIPS requirements. But it's not, and that's the problem.

I don't understand the concern here?

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#46

Post by randomstuffs »

eptcyka wrote: post #21
LunaSea wrote: post #19

Earlier quoted context omitted.

Could you expand on the design flaw in question?

OpenVPN looks like a regular tls stream - difficult to distinguish between that and a HTTPS connection. WireGuard looks like WireGuard. But you can wrap WireGuard in whatever headers you might want to obfuscate it and the perf will still be better.

[dead]

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#47

Post by coppsilgold »

tptacek wrote: post #44
coppsilgold wrote: post #34

It's unfortunate that WireGuard doesn't include a switch that if both sides agree the crypto in use would be AES and SHA256. Not due to FIPS compliance but performance and power savings. I never once used WireGuard on hardware that didn't have AES and SHA intrinsics, all that battery wasted.

A core part of the security design of WireGuard is not negotiating cryptography.

No one suggests the negotiated mess that exists in most standards. A single binary switch to account for hardware acceleration when it's available on both ends would have been a good decision.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#48

Post by arter45 »

cookiengineer wrote: post #40

> XChaCha20-Poly1305 replaced with AES-256-GCM What could possibly go wrong? It's not like every CTF ever designed has a block cipher or counter mode challenge. /s If the project wasn't done by WolfSSL, I would have assumed it's a trolling attempt to mock FIPS requirements. But it's not, and that's the problem.

Are you talking about side channel attacks? Because AFAIK nonce reuse is an issue in both cases.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#49

Post by gormami »

For all those saying that FIPS is a step backwards in crypto, you are right, the standards always lag the state of the art. That said, CMMC is coming into it's own in the US MilGov space, and a LOT of small businesses need to be CMMC compliant, which requires FIPS certified crypto. So having an open sourced FIPS compliant option is a good thing for them. Good on WolfSSL for helping out that space.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#50

Post by derektank »

IncRnd wrote: post #27
usui wrote: post #8

I know software developers complain about forced compliance due to the security theatre aspects, but I would like to charitably ask from someone who has technical understanding of FIPS-compliant cryptography. Are there any actual security advantages on technical grounds for making WireGuard FIPS-compliant? Assume the goal is not to appease pencil pushers. I really want to know if this kind of effort has technical gai…

If you're considering whether to use a FIPS 140-3 module for your cryptography, consider that FIPS 140-3 is really only for specific compliance verticals. If you don't know whether you need it, you probably don't need it. So, along those lines, if you wonder whether a package's cryptography should be FIPS 140-3 compliant, then the real question is whether you are a vertical that needs to be compliant. Again, if you a…

>Again, if you aren't sure, the answer is likely NO.

Likely no, I agree. But I think there are probably a lot of companies selling enterprise software that later attempt to solicit a FedRAMP authorization that would benefit from planning ahead and building a compliant version from the jump. Worth considering and having a conversation internally.

Post reply on HN