Re: Support FIDO2/CTAP2 security tokens as keystore

From: Phil Hofer <phil@sunfi.sh>
To: Nicolas Stalder <n+wireguard@stalder.io>
Cc: "wireguard@lists.zx2c4.com" <wireguard@lists.zx2c4.com>
Subject: Re: Support FIDO2/CTAP2 security tokens as keystore
Date: Fri, 30 Aug 2019 18:00:58 +0000	[thread overview]
Message-ID: <IbEVN_YV6xE7Vh_wFFWoxkYMb8EjgKtSRUXP3Zs0IWDS51pGuSCjwLxAyuBZR8sweVVHN-V2gctoBYEgxUr_v15pHnRjpMELrzGo1XG3wN0=@sunfi.sh> (raw)
In-Reply-To: <CACzkAFoO3==OiS0jgu1rHuHBo5_F-6XkcDW=gBN8p81F70bmKg@mail.gmail.com>

[-- Attachment #1.1.1: Type: text/plain, Size: 890 bytes --]

>     If my understanding is correct, the bare minimum functionality is:
>     

> -   store key non-extractably on device (unless you're Colin O'Flynn...)
>     (if there is an issue, just rotate the key)
>     

> -   periodically do Curve25519 Diffie-Hellman to generate sessions keys
>     (that are revealed to the client, possibly with some sort of
>     transport layer security)

Are there HSMs out there that performs ECDHE fast enough
to make this reasonably DoS-proof?

The last HSM I worked with was a ("cheap," $650) YubiHSM that still
took a pretty long time (~250ms) to do ECDHE. Fine for cert
management, but no good for pointing at the internet.

An alternative that would tolerate slow HSMs would be to
periodically rotate the Wireguard host key with an attestation
from the HSM, but then you'd need an out-of-band key distribution
solution.

- Phil

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 477 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard