4 ms·

Why not just use PresharedKey in Wireguard?

d-z-m 4y ago
You still can. The problem arises when you don't actually wanna pre-share the key, and you still want post-quantum forward secrecy. Then you need a PQ KEM like McEliece or Kyber to run a PQ-secure key establishment.
gzer0 4y ago
Using a PSK alone doesn't make WireGuard quantum-safe. The security of the key exchange mechanism in WireGuard, which relies on the Diffie-Hellman protocol, is still vulnerable to quantum attacks. If an attacker were to obtain the PSK and use a quantum computer to break the Diffie-Hellman key exchange, they would be able to decrypt the VPN traffic. This is currently the thought-process and main reason behind why PQWG (Post Quantum Wireguard) are actively being researched [1]. [1] https://ieeexplore.ieee.org/document/9519445/ https://ieeexplore.ieee.org/document/9519445/
- ThePhysicist 4y ago
  Wireguard explicitly mentions that mixing in a PSK provides post-quantum security [1]. 1: https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/
  - majewsky 4y ago
    Please be careful in your quoting. The page you linked says "post-quantum resistance", not "post-quantum security" (which would be a much stronger claim).
- deleted 4y ago
  [deleted]
- d-z-m 4y ago
  > Using a PSK alone doesn't make WireGuard quantum-safe. Not sure what you're trying to say here. If you share the PSK out-of-band, securely, then wireguard is quantum resistant (I wouldn't say quantum-safe, because I'm not that optimistic). > If an attacker were to obtain the PSK Indeed if the attacker obtains the PSK then obviously the PSK isn't going to help you.
- yjftsjthsd-h 4y ago
  > If an attacker were to obtain the PSK I believe it is traditional, in most threat models, to assume that the attacker doesn't have your private keys.
Fnoord 4y ago
You can do that on top of a public/private keypair, too.
miloignis 4y ago
That's what they're doing, generating a key using post-quantum crypto and using it as the PSK - from TFA: "The tool establishes a symmetric key and provides it to WireGuard. Since it supplies WireGuard with key through the PSK feature using Rosenpass+WireGuard is cryptographically no less secure than using WireGuard on its own ("hybrid security"). Rosenpass refreshes the symmetric key every two minutes."
CodesInChaos 4y ago
That doesn't solve the key management problem, it just defines it as out-of-scope, since you still need to exchange that preshared key outside Wireguard.
sevenoftwelve 4y ago
Author here; We are :) Rosenpass is a fancy way of generating a PSK for WireGuard.
foobiekr 4y ago
Why not just use preshared keys in all VPNs like IPSEC? Because key exchange and key rotation is a huge problem.
- yjftsjthsd-h 4y ago
  Is it any harder than exchanging and rotating asymmetric keys?

You still can. The problem arises when you don't actually wanna pre-share the key, and you still want post-quantum forward secrecy. Then you need a PQ KEM like McEliece or Kyber to run a PQ-secure key establishment.

gzer0 4y ago

Using a PSK alone doesn't make WireGuard quantum-safe. The security of the key exchange mechanism in WireGuard, which relies on the Diffie-Hellman protocol, is still vulnerable to quantum attacks. If an attacker were to obtain the PSK and use a quantum computer to break the Diffie-Hellman key exchange, they would be able to decrypt the VPN traffic. This is currently the thought-process and main reason behind why PQWG (Post Quantum Wireguard) are actively being researched [1]. [1] https://ieeexplore.ieee.org/document/9519445/ https://ieeexplore.ieee.org/document/9519445/

ThePhysicist 4y ago
Wireguard explicitly mentions that mixing in a PSK provides post-quantum security [1]. 1: https://www.wireguard.com/protocol/ https://www.wireguard.com/protocol/
- majewsky 4y ago
  Please be careful in your quoting. The page you linked says "post-quantum resistance", not "post-quantum security" (which would be a much stronger claim).
deleted 4y ago
[deleted]
d-z-m 4y ago
> Using a PSK alone doesn't make WireGuard quantum-safe. Not sure what you're trying to say here. If you share the PSK out-of-band, securely, then wireguard is quantum resistant (I wouldn't say quantum-safe, because I'm not that optimistic). > If an attacker were to obtain the PSK Indeed if the attacker obtains the PSK then obviously the PSK isn't going to help you.
yjftsjthsd-h 4y ago
> If an attacker were to obtain the PSK I believe it is traditional, in most threat models, to assume that the attacker doesn't have your private keys.

Fnoord 4y ago

You can do that on top of a public/private keypair, too.

miloignis 4y ago

That's what they're doing, generating a key using post-quantum crypto and using it as the PSK - from TFA: "The tool establishes a symmetric key and provides it to WireGuard. Since it supplies WireGuard with key through the PSK feature using Rosenpass+WireGuard is cryptographically no less secure than using WireGuard on its own ("hybrid security"). Rosenpass refreshes the symmetric key every two minutes."

CodesInChaos 4y ago

That doesn't solve the key management problem, it just defines it as out-of-scope, since you still need to exchange that preshared key outside Wireguard.

sevenoftwelve 4y ago

Author here; We are :) Rosenpass is a fancy way of generating a PSK for WireGuard.

foobiekr 4y ago

Why not just use preshared keys in all VPNs like IPSEC? Because key exchange and key rotation is a huge problem.

yjftsjthsd-h 4y ago
Is it any harder than exchanging and rotating asymmetric keys?