Discussion
Search code, repositories, users, issues, pull requests...
AaronFriel: The conventional wisdom in cryptography is that if you don't know you need FIPS, if you don't have paper and a dollar figure telling you how much you need it, you don't need or want FIPS.
pphysch: Can't you also get FIPS 140-3 WireGuard by compiling wireguard-go with the new native FIPS support in Go?
PunchyHamster: So a step backward in security ?
kstrauser: In fairness, modern versions of FIPS are much less awful. AFAICT it's now possible to be FIPS compliant and meet reasonable crypto expectations, which was not always the case before.
usui: I know software developers complain about forced compliance due to the security theatre aspects, but I would like to charitably ask from someone who has technical understanding of FIPS-compliant cryptography. Are there any actual security advantages on technical grounds for making WireGuard FIPS-compliant? Assume the goal is not to appease pencil pushers. I really want to know if this kind of effort has technical gains.
alfanick: I presume it's a product strategy to provide a box of "compliant" libraries/services, so other companies can quickly tick and sign a checkbox saying "we use compliant VPN", because someone else is going to look whether the checkbox is ticked and signed, because someone else is going to...
elevation: Wireguard exemplifies the superiority of a qualified independent developer over the fractal layers of ossified cruft that you get from industry efforts and compliance STIGS.So it feels wrong to see wireguard adapted for compliance purposes. If compliance orgs want superior technology, let their standards bodies approve/adopt wireguard without modifying it.
jmclnx: Yes, but be aware, openvpn is much better if you live in a Country like China, Russia and a few others. That is due to a a known design issue with wireguard.For most people, wireguard is fine.
loeg: It's fine. None of the FIPS algorithms are known to be broken, either. The only risk here is implementation bugs doing the conversion and any maintenance burden incurred due to diverging from upstream wireguard.
briandw: [delayed]
johnisgood: Heh, I checked the cryptographic primitives WolfGuard uses, it is not for me. :D
LunaSea: Could you expand on the design flaw in question?
eptcyka: OpenVPN looks like a regular tls stream - difficult to distinguish between that and a HTTPS connection. WireGuard looks like WireGuard. But you can wrap WireGuard in whatever headers you might want to obfuscate it and the perf will still be better.
tptacek: No, there are not.
tptacek: It's trivial to make WireGuard look like a regular TLS stream. It's probably not worth a 15 year regression in security characteristics just to get that attribute; just write the proxy for it and be done with it. It was a 1 day project for us (we learned the hard way that a double digit percentage of our users simply couldn't speak UDP and had to fix that).
LtWorf: but wolfssl is in the business of selling FIPS compliance so…
alfanick: And they do it fast, thankfully Compliant Static Code Analyser catches issues like https://github.com/wolfSSL/wolfGuard/commit/fa21e06f26de201b...
johnisgood: Holy shit. Those are rookie mistakes, that could end up being SEVERE.
ongy: Crypto wise, fips is outdated but not horrible.Actual fips compliant (certified) gives you confidence in some basic competence of the solution.Just fips compatible (i.e. picking algos that could be fips compliant) is generally neutral to negative.I'm not 100% up to date, so that might have changed, but AEAD used to be easier if you don't follow fips than fips compatible. Still possible, but more foot guns due to regulatory lag in techniques.Overall, IMO the other top-level comment of "only fips if you have pencil pusher benefit" applies.
