5 ms·

Are there any official plans for 2FA in Wireguard?

by aeyes 7y ago

slim 7y ago
there is no authentication that would need a second factor in wireguard. in wireguard you authenticate the host, not a user
- slim 7y ago
  actually there is no athentication in wireguard. only identification
  - megous 7y ago
    Each node has a list of public keys of nodes that it authorizes to communicate with it. Those nodes authenticate (provide proof of their identity) themselves via the exclusive ownership of their private keys. So I don't see yout point.
tptacek 7y ago
My understanding is that the plan for WireGuard is to nail the engine and present a clean interface to system integrators, who will build their own authentication systems on top of it. The most sensible way to do MFA for WireGuard is probably though an IdP.
jasonjayr 7y ago
I think at this time, the only option you'd have is a captive portal for the 2FA, and then unfirewall the in-VPN IP. WG has no provision for "connection state", only "handshake happened X seconds ago". If there's no traffic, there's no handshake.
zhte415 7y ago
What would the point of 2FA be? Interested as a use-case I don't quite follow.
- rcxdude 7y ago
  If you are using a VPN to access a sensitive network (home or office), you want to make it harder for an attacker to steal keys or passwords to the network (especially since any roaming devices are more vulnerable to evil maid attacks). 2FA through a token or phone apps means they now need to compromise two devices instead of one.
  - zhte415 7y ago
    OK, I get you. I think we're coming from different angles. You're concerned about getting into a network, I'm concerned on not identifying identification. Thanks for the reply.
qzio 7y ago
While we wait for something proper, you can always "patch" it on top of the connection like a quick PoC I made: https://github.com/qzio/w2fau2f https://github.com/qzio/w2fau2f Also, see: https://lists.zx2c4.com/pipermail/wireguard/2017-September/001753.html https://lists.zx2c4.com/pipermail/wireguard/2017-September/0...

Are there any official plans for 2FA in Wireguard?

by aeyes 7y ago

Are there any official plans for 2FA in Wireguard?

slim 7y ago

there is no authentication that would need a second factor in wireguard. in wireguard you authenticate the host, not a user

slim 7y ago
actually there is no athentication in wireguard. only identification
- megous 7y ago
  Each node has a list of public keys of nodes that it authorizes to communicate with it. Those nodes authenticate (provide proof of their identity) themselves via the exclusive ownership of their private keys. So I don't see yout point.

tptacek 7y ago

My understanding is that the plan for WireGuard is to nail the engine and present a clean interface to system integrators, who will build their own authentication systems on top of it. The most sensible way to do MFA for WireGuard is probably though an IdP.

jasonjayr 7y ago

I think at this time, the only option you'd have is a captive portal for the 2FA, and then unfirewall the in-VPN IP. WG has no provision for "connection state", only "handshake happened X seconds ago". If there's no traffic, there's no handshake.

zhte415 7y ago

What would the point of 2FA be? Interested as a use-case I don't quite follow.

rcxdude 7y ago
If you are using a VPN to access a sensitive network (home or office), you want to make it harder for an attacker to steal keys or passwords to the network (especially since any roaming devices are more vulnerable to evil maid attacks). 2FA through a token or phone apps means they now need to compromise two devices instead of one.
- zhte415 7y ago
  OK, I get you. I think we're coming from different angles. You're concerned about getting into a network, I'm concerned on not identifying identification. Thanks for the reply.

qzio 7y ago

While we wait for something proper, you can always "patch" it on top of the connection like a quick PoC I made: https://github.com/qzio/w2fau2f https://github.com/qzio/w2fau2f Also, see: https://lists.zx2c4.com/pipermail/wireguard/2017-September/001753.html https://lists.zx2c4.com/pipermail/wireguard/2017-September/0...