Also, configuration settings that affect the security of the overall application cannot be modified by unprivileged users. If a flaw is found in any of the primitives, a new version can be released that resolves the issue. For ensuring security, WireGuard restricts the options for implementing cryptographic controls, limits the choices for key exchange processes, and maps algorithms to a small subset of modern cryptographic primitives. Įxcluding such complex features from the minimal core codebase improves its stability and security.
This has been used to augment WireGuard with various features including more user-friendly management interfaces (including easier setting up of keys), logging, dynamic firewall updates, and LDAP integration. WireGuard is designed to be extended by third-party programmes and scripts. Since point-to-point is supported, other topologies can be made, but not on the same tunnel. Client endpoints can be statically predefined.A client endpoint does not have to be defined before the client starts sending data.It supports only layer 3 for both IPv4 and IPv6 and can encapsulate v4-in-v6 and vice versa. WireGuard fully supports IPv6, both inside and outside of tunnel. This is unlike alternatives like OpenVPN because of the many disadvantages of TCP-over-TCP routing. WireGuard only uses UDP and thus does not work in networks that block UDP traffic. Pre-shared keys are "usually troublesome from a key management perspective and might be more likely stolen", but in the shorter term, if the symmetric key is compromised, the Curve25519 keys still provide more than sufficient protection. The risk being that traffic is stored until quantum computers are capable of breaking Curve25519 at which point traffic could be decrypted. WireGuard supports pre-shared symmetric key mode, which provides an additional layer of symmetric encryption to mitigate any future advances in quantum computing.
In May 2019, researchers from INRIA published a machine-checked proof of the WireGuard protocol, produced using the CryptoVerif proof assistant.
0 kommentar(er)
