I only have one problem with this. When they say wireguard being crypto opinionated is a good thing. I am weary to agree with that statement entirely.
While it is good for stability (only one stack to support and get right, and to be secure and efficient) I do wonder about overall and future security. Saying “You must use this specific cipher suite because we think it’s the best” is a bit of a dangerous road to take.
I say this just because Curve 25519 is considered a very secure elliptic curve, to the best of my very limited knowledge on this subject. But we had a certain dual elliptic curve pseudo random number generator was pushed as “best practice” (NIST backed) some time ago, which didn’t turn out so well, even omitting possible conspiracy scenarios, it had known weaknesses even before it was recommended. [1]
Since then I’ve generally not been a huge fan of being given one option as “the right way” when it comes to cryptography. Even if it is the “best” it gives one target to try to find a weakness in, rather than many.
I say all this as a wireguard user, it’s a great, fast and reliable VPN. I just have concerns when the choice of using other algorithms and especially putting my own chosen chain together is taken away. Because it puts the exact same target to break on every one of us, rather than having to work out how to break multiple methods and algorithms and multiple combinations.
a cryptosystem should be secure, even if everything about the system, except the key, is public knowledge
What this is saying is that in a secure cryptosystem all you need to secure is the key.
Curve 25519 is, for the time being, considered a secure cryptosystem. It’s likely that in the future it will become obsolete, but we’re not there yet. When we get there WG will port to a new cipher that is more secure.
Even if you set your configs to not negotiate, just the fact that the stack COULD negotiate opens you up to downgrade attacks. Also, anybody trying to connect would get some kind of hello/response traffic that would broadcast your (non negotiable) configs, so what do you gain from being able to choose, except the ability to make mistakes?
Well, I did think the “security through obscurity” line would come up. But that’s really something that should be reserved for people making their own “triple XOR” crypto implementations closed source and hoping that protects them.
The “obscurity” if it’s the term we want to use here in my use case isn’t hiding using closed source to provide a perception of security. It’s just giving a choice of crypto, but not adding to the protocol with negotiation.
My thinking is this, and we’ll look at say ssh. We can choose between multiple key types and lengths for that. Now let’s say for example ed25519 is compromised (in real terms I think the only likely compromise for any of the ssh key based auth options would be deriving a private key from the public key, so the “scanning” I talk about is a fantasy. But I’m going with it!). For ssh, there will for sure be bots hunting the internet for vulnerable ssh servers very soon after. Automating the process of getting in, installing whatever nefarious tools they want and moving on. But, crucially they will only get those that have used ed25519 for their auth key login. However they might well get every single wireguard vpn.
I’m really just advocating for the same option really. The option to not use the same as everyone else. With no reduction in security for anyone else and no need to negotiate, the onus would entirely be on the operator to ensure the same stack is configured on client and server. Of course with the understanding that using any other stack is at your own risk. E.g. “triple XOR” security might not be the best, for example :P
Oh and as I said, I doubt I would use it. I use wireguard as it is, I like wireguard as it is. But, I feel like having options is not a bad thing, provided the default is the “best” option currently known.
I think the idea behind opinionated cryptography is not only the idea of “We think this is the best, so you have to use it”, but most importantly it removes all requirements of the protocol supporting cipher negotiation. This makes the protocol much simpler, easier to audit and as a result more secure. And if the cryptography in the protocol ever shows a weakness, then Wireguard v2 needs to be released as a breaking change.
See all the SSL/TLS versions
Yep. I entirely agree about the good points. I am just always weary about removing options like this, regardless of intention.
I’d be fine if for example I’m running my own wireguard implementation, I could choose the suite to use, not negotiate anything and ensure my client has the same configuration.
I’d probably not use it, but I like the option, and knowing that anyone that wants to try to break this now also needs to guess what options I’m running.
knowing that anyone that wants to try to break this now also needs to guess what options I’m running.
Unless your security model has you being specifically targeted by advanced threat actors, the most likely scenario is that you’ll be affected by randomly discovered security vulnerabilities and not individuals tailoring an attack for your configuration.
Obfuscation of your configuration doesn’t add much security and using obscure settings could just as easily result in security vulnerabilities of their own. Vulnerabilities which, due to the obscurity of your configuration, may not be discovered by white hats for much longer.
I know that, if wireguard is exploitable, it’s very unlikely to be me that would be targeted. There are larger and more lucrative targets acting as honeypots for everyone else.
I only have one problem with this. When they say wireguard being crypto opinionated is a good thing. I am weary to agree with that statement entirely.
While it is good for stability (only one stack to support and get right, and to be secure and efficient) I do wonder about overall and future security. Saying “You must use this specific cipher suite because we think it’s the best” is a bit of a dangerous road to take.
I say this just because Curve 25519 is considered a very secure elliptic curve, to the best of my very limited knowledge on this subject. But we had a certain dual elliptic curve pseudo random number generator was pushed as “best practice” (NIST backed) some time ago, which didn’t turn out so well, even omitting possible conspiracy scenarios, it had known weaknesses even before it was recommended. [1]
Since then I’ve generally not been a huge fan of being given one option as “the right way” when it comes to cryptography. Even if it is the “best” it gives one target to try to find a weakness in, rather than many.
I say all this as a wireguard user, it’s a great, fast and reliable VPN. I just have concerns when the choice of using other algorithms and especially putting my own chosen chain together is taken away. Because it puts the exact same target to break on every one of us, rather than having to work out how to break multiple methods and algorithms and multiple combinations.
[1] https://en.wikipedia.org/wiki/Dual_EC_DRBG
It sounds as if you’re falling prey to the allure of security through obscurity.
I’d like to remind you of Kerckhoff’s Principle.
a cryptosystem should be secure, even if everything about the system, except the key, is public knowledge
What this is saying is that in a secure cryptosystem all you need to secure is the key.
Curve 25519 is, for the time being, considered a secure cryptosystem. It’s likely that in the future it will become obsolete, but we’re not there yet. When we get there WG will port to a new cipher that is more secure.
Even if you set your configs to not negotiate, just the fact that the stack COULD negotiate opens you up to downgrade attacks. Also, anybody trying to connect would get some kind of hello/response traffic that would broadcast your (non negotiable) configs, so what do you gain from being able to choose, except the ability to make mistakes?
Well, I did think the “security through obscurity” line would come up. But that’s really something that should be reserved for people making their own “triple XOR” crypto implementations closed source and hoping that protects them.
The “obscurity” if it’s the term we want to use here in my use case isn’t hiding using closed source to provide a perception of security. It’s just giving a choice of crypto, but not adding to the protocol with negotiation.
My thinking is this, and we’ll look at say ssh. We can choose between multiple key types and lengths for that. Now let’s say for example ed25519 is compromised (in real terms I think the only likely compromise for any of the ssh key based auth options would be deriving a private key from the public key, so the “scanning” I talk about is a fantasy. But I’m going with it!). For ssh, there will for sure be bots hunting the internet for vulnerable ssh servers very soon after. Automating the process of getting in, installing whatever nefarious tools they want and moving on. But, crucially they will only get those that have used ed25519 for their auth key login. However they might well get every single wireguard vpn.
I’m really just advocating for the same option really. The option to not use the same as everyone else. With no reduction in security for anyone else and no need to negotiate, the onus would entirely be on the operator to ensure the same stack is configured on client and server. Of course with the understanding that using any other stack is at your own risk. E.g. “triple XOR” security might not be the best, for example :P
Oh and as I said, I doubt I would use it. I use wireguard as it is, I like wireguard as it is. But, I feel like having options is not a bad thing, provided the default is the “best” option currently known.
I think the idea behind opinionated cryptography is not only the idea of “We think this is the best, so you have to use it”, but most importantly it removes all requirements of the protocol supporting cipher negotiation. This makes the protocol much simpler, easier to audit and as a result more secure. And if the cryptography in the protocol ever shows a weakness, then Wireguard v2 needs to be released as a breaking change. See all the SSL/TLS versions
Yep. I entirely agree about the good points. I am just always weary about removing options like this, regardless of intention.
I’d be fine if for example I’m running my own wireguard implementation, I could choose the suite to use, not negotiate anything and ensure my client has the same configuration.
I’d probably not use it, but I like the option, and knowing that anyone that wants to try to break this now also needs to guess what options I’m running.
No. You are making assumptions about security and ultimately assuming you’re the only one who thought this along the way.
Unless your security model has you being specifically targeted by advanced threat actors, the most likely scenario is that you’ll be affected by randomly discovered security vulnerabilities and not individuals tailoring an attack for your configuration.
Obfuscation of your configuration doesn’t add much security and using obscure settings could just as easily result in security vulnerabilities of their own. Vulnerabilities which, due to the obscurity of your configuration, may not be discovered by white hats for much longer.
I know that, if wireguard is exploitable, it’s very unlikely to be me that would be targeted. There are larger and more lucrative targets acting as honeypots for everyone else.