WireGuard obfuscation & active probing: staying virtuous under pressure

[Ian Chen]

> WireGuard over Shadowsocks-2022
> ===============================
> 
> TL;DR: Too much crypto + deployment challenges.
> 
> Shadowsocks is a good solution against censor, but it strips 40 more
> bytes from MTU and AEADs data twice: XChaCha20-Poly1305 of
> Shadowsocks +
> ChaCha20-Poly1305 of WireGuard burning twice as much carbon credits.
> Performance matters: e.g. Mullvad introduces LWO claiming performance
> improvement over Shadowsocks.

I developed swgp-go around the same time I wrote the spec for
Shadowsocks 2022. At the time, I intentionally left replay protection
out of swgp-go, because I thought WireGuard wouldn't need it.

Thanks to your work, I now understand that this assumption was wrong!
So I added it into swgp-go:
https://github.com/database64128/swgp-go/commit/207a055ab0a1058579f299fc1021cc64c95b21db

The new "zero-overhead-2026" and "paranoid-2026" modes provide replay
protection for handshake packets. Replayed packets are dropped by
checking the nonce and an encrypted unix epoch timestamp, similar to
how Shadowsocks 2022's TCP construction does it.

This won't address the "DoSer" scenario, but should provide enough
protection against censors without knowledge of the OBFSK.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: This is a digitally signed message part
URL: <http://lists.zx2c4.com/pipermail/wireguard/attachments/20260422/cf13356a/attachment.sig>