The presentation will be divided up into several parts. First, there will be an overview of the problems with IPsec, OpenVPN, and other popular VPNs, outlining attacks and weaknesses. Next, the WireGuard idea of the "cryptokey routing table" will be introduced, and we’ll walk through several properties derived from it. This will transition into a discussion of the timer state mechanism, and how secure protocols are necessarily stateful, but it’s possible to make them appear stateless to the user by exhaustively defining all possible state transitions. Then we’ll get into the hardcore meat of the presentation: the cryptography and various crypto innovations behind WireGuard. We will discuss the triple Diffie-Hellman, the role of combining static and ephemeral keys, the performance and DoS-potential of Curve25519 point multiplication, using a PRF chaining for rotating keys, identity hiding and remaining silent on a network, and clever usage of authenticated encryption with additional data. We will examine the various attack models, and enumerate the cryptographic mitigations employed by WireGuard. The sum will be a comprehensive overview of modern day crypto tricks, attacks, and useful constructions, and how these insights have been funneled into WireGuard. Finally, we’ll examine the Linux kernel implementation of WireGuard, seeing how it’s possible to avoid allocations in response to unauthenticated packets as a defense coding technique. During the presentation, a live WireGuard endpoint will be provided to audience members who wish to send packets, whether encrypted, legitimate, malformed, dubious, or otherwise curious.

Threaded throughout will be an enumeration of attacks on existing protocols and cryptographic tricks for their mitigation.

My background is in security -- kernels, hardware, reversing, crypto, large networks, etc -- and as such I've broken a lot of systems with some novel tricks and protocol insights. WireGuard is motivated by a sort of cornucopia of clever attacks (crypto and otherwise) against other networks. I made it because I wanted something I could actually confidently run on my own infrastructure, and none of the other tools were nearly up to the task. So, this talk is going to go into depth about real attacks on various protocols, in addition to unveiling some techniques to avoid entire classes of attacks.

Finally, since WireGuard is initially implemented for the Linux kernel, there have been some very interesting considerations to account for with kernel programming. Cross platform implementations are also in the works, written in Go and Rust.