Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Same problem with Wireguard and NTP.

You can't (usefully) tunnel NTP inside of wireguard, because if your clock is wrong your peers won't talk to you anymore.

This is my personal pet peeve.

IMHO the wireguard handshake needs to be extended to allow one peer (the one that didn't reboot) to reply to a packet with a non-monotonically-increasing nonce with some signal saying "hey, here is the last nonce I got from you". Obviously this reply would be encrypted.

Then hazmat-free hardware could use these replies to reset its nonce (for that particular peer only) if we haven't had a successful handshake with that peer since the last reboot and/or the system clock is implausible. Obviously this behavior would be off-by-default. I would enable it for my batteryless routers.



I think the solution here is to get on finally securing NTP, not try to hack around it


That's a fairly glib comment; have you thought it through?

Most of the "secure this" wrappers like TLS+X.509 assume a clock.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: