Preshared Key Rework Coming Soon
Jason A. Donenfeld
Jason at zx2c4.com
Thu May 11 22:32:23 CEST 2017
Since the last discussion of preshared key mode in WireGuard, we've
made some substantial progress. Trevor and I have been working out the
cryptodetails , and Kevin and I have been tweaking our formal
verification model. Everything is coming together quite nicely on that
For those who are just catching up on this discussion, the gist is
that the PresharedKey attribute is moving from being part of the
Interface to part of the Peer. This will enable PSKs to be a pair-wise
value, rather than having an Interface use one PSK for all its peers,
a significant security improvement.
I've written up the changes in the whitepaper  and the protocol doc
. I've implemented it in the latest git master, though probably you
should wait for the next snapshot to try it out. I'm now in the
progress of writing  patches  for various  WireGuard
integrations, so that when I release the next snapshot, things can
transition over smoothly, in addition to various Noise libraries .
If all goes well, the Noise changes will be out on Tuesday, and the
snapshot should happen minutes after that.
Let me know if there are any questions.
More information about the WireGuard