I just learned that #Wireguard will automatically and correctly clamp any private 32-byte key.
For example:
$ openssl rand -base64 32
tx6Kwv9L17ARq8WOd0M3sjm8gKU8bmdoSeBoGTzyEyY=
Even though the first and last bytes are not properly clamped above, when generating the public key, the wg(8) tool will clamp it. Further, when bringing up the interface, Wireguard will also clamp it.
See https://git.zx2c4.com/wireguard-tools/tree/src/genkey.c and https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireguard/noise.c (search for "curve25519_clamp_secret")
#cryptography
Aaron Toponce ⚛️:debian: /
npub14d…s5uyy
2023-05-05 11:37:39
Author Public Key
npub14dfr55yyvfw0leduur7e4af7fnkeegww6e2n64laxkkdyn4sufrqhs5uyyPublished at
2023-05-05 11:37:39Event JSON
{
"id": "464e7c4b83990d4c6adedadcb9e7d68a7959c2051903d322af0b625f38f306b7",
"pubkey": "ab523a5084625cffe5bce0fd9af53e4ced9ca1ced6553d57fd35acd24eb0e246",
"created_at": 1683286659,
"kind": 1,
"tags": [
[
"t",
"wireguard"
],
[
"t",
"cryptography"
],
[
"mostr",
"https://fosstodon.org/users/atoponce/statuses/110315874543421414"
]
],
"content": "I just learned that #Wireguard will automatically and correctly clamp any private 32-byte key.\n\nFor example:\n\n$ openssl rand -base64 32\ntx6Kwv9L17ARq8WOd0M3sjm8gKU8bmdoSeBoGTzyEyY=\n\nEven though the first and last bytes are not properly clamped above, when generating the public key, the wg(8) tool will clamp it. Further, when bringing up the interface, Wireguard will also clamp it.\n\nSee https://git.zx2c4.com/wireguard-tools/tree/src/genkey.c and https://git.zx2c4.com/wireguard-linux/tree/drivers/net/wireguard/noise.c (search for \"curve25519_clamp_secret\")\n\n#cryptography",
"sig": "7592329bd1f2d413d28996271dc3f0238ca1f78f466a42e0af9d63b260199ef842e3dd527daabebea2c2c48c709f5dad302f5c3ac35505654b8d2793fcf0a782"
}