Not really TAI64N

[Vlad Krasnov]

The WireGuard spec states that a timestamp used is TAI64N, however the wireguard-go implementation produces an invalid timestamp, because the Go function now.UnixNano() returns the total number of nanoseconds from epoch and truncated to 32bit, whereas TAI64N requires it to be in the range [0, 999999999].

Moreover the kernel implementation does not check if a timestamp is valid TAI64N at all, it simply checks that this is a monotonically increasing, 12 byte long, big endian number.

While this is probably not insecure, it goes against what is stated in the whitepaper.

Also, the function used for comparison is memcmp, non-constant time function, that shouldn’t be used in cryptographic context.

Cheers,
Vlad