WolfGuard: WireGuard with FIPS 140-3 cryptography • Hacker News Board

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#61

Post by rainsford » Wed, Mar 25, 2026, 12:27 AM UTC

coppsilgold wrote: post #34

It's unfortunate that WireGuard doesn't include a switch that if both sides agree the crypto in use would be AES and SHA256. Not due to FIPS compliance but performance and power savings. I never once used WireGuard on hardware that didn't have AES and SHA intrinsics, all that battery wasted.

I'll take the possibly controversial position that WireGuard's opinionated approach to cryptographic choices without the option for negotiation was indeed the right call, but it would have been a better and even more successful protocol if it used FIPS compliant cryptography.

Taking the DJB crypto path gave Wireguard some subtle advantages to implementation ease-of-use that are almost entirely overshadowed by the difficultly in building a new, secure cryptographic protocol from scratch regardless of what algorithms you're using. The tradeoff was that there are plenty of places it will never be used due to standards compliance requirements which as you point out also has significant implications for efficiency in hardware.

Wireguard is cool. I think very little of that coolness has to do with the DJB vs NIST cryptographic choices. And taking the DJB path unnecessarily limited the impact of its coolness at least for now.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#62

Post by tptacek » Wed, Mar 25, 2026, 3:07 AM UTC

rainsford wrote: post #61

coppsilgold wrote: post #34

It's unfortunate that WireGuard doesn't include a switch that if both sides agree the crypto in use would be AES and SHA256. Not due to FIPS compliance but performance and power savings. I never once used WireGuard on hardware that didn't have AES and SHA intrinsics, all that battery wasted.

I'll take the possibly controversial position that WireGuard's opinionated approach to cryptographic choices without the option for negotiation was indeed the right call, but it would have been a better and even more successful protocol if it used FIPS compliant cryptography. Taking the DJB crypto path gave Wireguard some subtle advantages to implementation ease-of-use that are almost entirely overshadowed by the dif…

I think cryptography engineers increasingly agree with this take, but it's also a different world: it would be straightforward to do XAES and modern P-curve implementations (now that they've been worked out with complete addition and stuff like that) now, but that was less the case when WireGuard was first published.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#63

Post by pseudohadamard » Wed, Mar 25, 2026, 5:32 AM UTC

jandrese wrote: post #43

AaronFriel wrote: post #2

The conventional wisdom in cryptography is that if you don't know you need FIPS, if you don't have paper and a dollar figure telling you how much you need it, you don't need or want FIPS.

FIPS just locks you into a specific (generally fairly old) version of everything and sets some more annoying defaults. The only benefit is to be able to check a box on a form saying you qualify.

It's not just that, would you rely on crypto code from Jason Donenfeld or crypto code from "all the CVEs" WolfSSL, https://www.wolfssl.com/docs/security-vulnerabilities/?

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#64

Post by MisterTea » Wed, Mar 25, 2026, 3:07 PM UTC

gnarlynarwhal42 wrote: post #60

MisterTea wrote: post #55

Earlier quoted context omitted.

In the process of becoming CMMC compliant. Contractor is supposedly "the best in the industry and well respected" but is clearly ignorant of anything beyond the most basic MS AD setup paired with Cisco Gear. My favorite part is the security policies CMMC requires are bonkers like IT needing to evaluate and white list individual websites. So if a worker is doing research and needs to visit dozens of websites you have…

Are you referring to SC.L2-3.13.6? The intent of this control is absolutely not to require a whitelist of individual websites. This control is meant to apply to ports and protocols aka tighten up and document your firewall rules If you are referring to SI.L2-3.14.7, you also do not need to whitelist websites. A pDNS service helps here but is not required. There are free options available, one of which is offered to s…

Thank you for that information.

I am unfortunately now ignorant in this area. Without going into detail I was partly involved with IT but no longer after a restructuring and "staff reduction." IT duties were fully transferred to the CMMC vendor. The vendor is either ignorant or lying as they may be a reseller or getting kick backs for the white list. Frustrating but I am now powerless.

Re: WolfGuard: WireGuard with FIPS 140-3 cryptography

#65

Post by tatersolid » Wed, Mar 25, 2026, 3:24 PM UTC

ongy wrote: post #26

usui wrote: post #8

I know software developers complain about forced compliance due to the security theatre aspects, but I would like to charitably ask from someone who has technical understanding of FIPS-compliant cryptography. Are there any actual security advantages on technical grounds for making WireGuard FIPS-compliant? Assume the goal is not to appease pencil pushers. I really want to know if this kind of effort has technical gai…

Crypto wise, fips is outdated but not horrible. Actual fips compliant (certified) gives you confidence in some basic competence of the solution. Just fips compatible (i.e. picking algos that could be fips compliant) is generally neutral to negative. I'm not 100% up to date, so that might have changed, but AEAD used to be easier if you don't follow fips than fips compatible. Still possible, but more foot guns due to r…

FIPS-140 allowed encryption using 3DES up until Jan 1 2024, and allowed certification of modules containing SHA-1 through the end of 2025. There is some transition-timeline nuance involved, but those examples are in general pretty horrible from a security perspective.