Repository navigation
Conversation
Bump tailscale.com from a0e471a35b8f to 911d8f84a054 (201 commits). This brings in wireguard-go's optional hybrid post-quantum (ML-KEM-768) handshake and the wgcfg.PeerConfig.Hybrid field that enables it per peer (tailscale/tailscale#21844), which tailcat will use next. Regenerate the release omit tag lists (build-tags.txt and .goreleaser.yaml) for the new upstream exitnodehealth feature. Updates #133 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I037bf98ae3d5383bfc47deae074e1e2953489b0b
Add an experimental "tailcat serve --hybrid" flag (Server.Hybrid in
the Go API) that makes the server use wireguard-go's hybrid
post-quantum (ML-KEM-768) WireGuard handshake. Unlike the pre-shared
key's post-quantum protection, this doesn't depend on the tailcat
address staying secret, so it also protects servers whose addresses
are published, as in DNS TXT records.
Both peers must agree on the handshake type, with no fallback, so
hybrid addresses say so with a new CBOR bool ("y", omitted when false)
and clients set the matching wgcfg.PeerConfig.Hybrid.
With the hybrid handshake, the pre-shared key only needs to keep out
strangers who know the server's public key, such as a DERP operator,
so hybrid addresses carry just 128 bits of it (zero-padded to the
WireGuard key size), making them shorter. 128 bits rather than fewer
because any client the server admits gets a handshake response it can
test guesses against offline.
The shorter key also makes clients from before this change fail early:
they require a 32-byte key in the "q" field, so they reject hybrid
addresses at parse time instead of retrying a classic handshake that
can never succeed. (Renaming the required server key field wouldn't
have: old clients don't check that it's present.) Hybrid addresses
made with --psk=false have no such early failure.
Updates #133
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: I496cab05fe004f041131dbe9b85381e06baea48e
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add an experimental "tailcat serve --hybrid" flag (Server.Hybrid in
the Go API) that makes the server use wireguard-go's hybrid
post-quantum (ML-KEM-768) WireGuard handshake. Unlike the pre-shared
key's post-quantum protection, this doesn't depend on the tailcat
address staying secret, so it also protects servers whose addresses
are published, as in DNS TXT records.
Both peers must agree on the handshake type, with no fallback, so
hybrid addresses say so with a new CBOR bool ("y", omitted when false)
and clients set the matching wgcfg.PeerConfig.Hybrid.
With the hybrid handshake, the pre-shared key only needs to keep out
strangers who know the server's public key, such as a DERP operator,
so hybrid addresses carry just 128 bits of it (zero-padded to the
WireGuard key size), making them shorter. 128 bits rather than fewer
because any client the server admits gets a handshake response it can
test guesses against offline.
The shorter key also makes clients from before this change fail early:
they require a 32-byte key in the "q" field, so they reject hybrid
addresses at parse time instead of retrying a classic handshake that
can never succeed. (Renaming the required server key field wouldn't
have: old clients don't check that it's present.) Hybrid addresses
made with --psk=false have no such early failure.
Updates #133