1 RISK ASSESSMENT OF WIREGUARD VPN Julia Alforde School of Library, Archival and Information Studies University of British Columbia 23 November 2019 2 TABLE OF CONTENTS INTRODUCTION 3 RISK ASSESSMENT PURPOSE 3 Scope 4 Date risk assessment was conducted: November 23, 2019 4 Overall Level of Risk 4 Number of Risks Identified for Each Level of Risk 4 Risk Model 5 BODY OF THE REPORT 6 Security Architecture of WireGuard 6 Threats, Vulnerabilities and Impact if Threats are Exploited 7 Risk Level Matrix 8 Risk Assessment Results Summary Table 9 Threat Categories 9 Recommendations 10 Citations 12 3 INTRODUCTION WireGuard is a Virtual Private Network (VPN) being developed by service provider NordVPN with hopes of becoming a new VPN industry standard. A VPN is a communication tunnel which allows clients to tunnel information from point-to-point across a potentially untrusted network (Stewart, et al., 155). WireGuard is an anticipated protocol currently under heavy development that aims to provide a more secure solution for VPN tunneling and to out-perform commonly used IPsec encryption protocol speed and OpenVPN implementation and management issues (Donenfeld, “Fast, Modern”). Given the popular use of VPNs globally, the technology behind the service is changing in hope of better protecting clients and client information by providing higher standards of privacy, secrecy, and faster speeds. In technical terms, WireGuard is a secure network tunnel operating on layer 3 that uses “a peer public key and a tunnel source IP address… in a single round trip key exchange” (Donenfeld, “Next Generation” 1). Its proposed high-speed transport depends on ChaCha20 symmetric encryption combined with Poly13 authentication on User Datagram Protocol (UDP) networks for packet encapsulation. It is not, however, involved with key distribution (Donenfeld, “Next Generation” 1). A VPN is a communication security tool, and WireGuard’s enhancements to the current VPN technology are meant to increase the operability and privacy of the well-known NordVPN service. The service is still under development, and use should be confined to testing purposes at this time. RISK ASSESSMENT PURPOSE The purpose of this NIST Special Publication 800-30 Tier 3 risk assessment is to analyze the security of WireGuard by identifying vulnerabilities, potentially exploitable threats, assessing the probability of occurrence, and assessing the impact of a threat occurrence to WireGuard clients and systems. It will conclude with recommendations for risk mitigation, and an identification of which threats contribute to the loss of confidentiality, integrity, and availability within the WireGuard system. Multiple VPN service providers are lining up to offer WireGuard’s services, however, the service is still under heavy development, and has not yet produced a complete product (Taylor). Developers and clients alike should be wary of adopting WireGuard at this stage because it has not undergone a formal security audit. This risk assessment is only a preliminary and superficial overview of the potential threats to the confidentiality, integrity, and availability of WireGuard’s service, and potential clients are not encouraged to enroll in the service before a security audit is produced. 4 Scope Date risk assessment was conducted: November 23, 2019 The scope of this risk assessment will encompass risks related to threats such as malicious attacks and accidental system failures as well as consider the impacts to clients, client data, and future system operations. The scope of this risk assessment is considered high level and cannot identify every environmental or user-specific threat, nor can it recommend detailed solutions to those threats. The identified primary assumption is that WireGuard is a relatively secure service to common household information systems, and that exploitable threats and vulnerabilities within the system will be minimal. This risk assessment is qualitative in nature and uses the NIST Special Publication 800-30: Guide for conducting risk assessments (No. NIST SP 800-30r1) and Arthur Rot’s Risk Level Matrix - an interpretation of the NIST approach to determining risk level (Rot 6).1 The risks are rated at one of three levels: LOW, MODERATE, and HIGH. A risk model is included on page five of the report, which identifies the analysis item, explanation, and metric used to explain each item of this assessment and how it is measured. Overall Level of Risk Scale Level of Impact LOW Minor Impact MODERATE Notable Impact HIGH Substantial Impact Number of Risks Identified for Each Level of Risk 1 In his work “Quantitative and Qualitative Approach for IT Risk Assessment” Arthur Rot uses the NIST Special Publication 800-30 Risk Assessment Report to inform his qualitative matrix on qualitative impact level. 5 Scale Number of Risks Identified LOW 2 MODERATE 1 HIGH 1 Risk Model Analysis Item Explanation Metric Used Vulnerabilities, Threats, and Identification of 1. Identify system Impact if Threats are vulnerabilities in WireGuard’s vulnerabilities. Exploited architecture; potential threats 2. Identify potential threats if if vulnerabilities are vulnerabilities exploited. exploited; impact to 3. Explain who is impacted, WireGuard systems and and how, by the occurrence of clients. a threat event. Risk Level Matrix Establishes hierarchy of Arthur Rot’s Risk Level impact severity if threats are Matrix. exploited. A multiplication of the probability of incident occurrence (high probability receives a 1.0 weight, medium 0.5, and low 0.1) and the severity of incident impact (high impact receives 100 weight, medium 50, and low 10). Risk Assessment Results Examines each threat and its Low: a minor incident solved Summary Table probability; adverse impact; by regular business processes and risk rating. in the course of day-to-day operations and expenditures. Moderate: A non-routine incident that disrupts operations and involves additional expenditures to recover from. High: a severely impactful 6 incident which threatens the operability and security of the system. Threat Categories A threat classification. Classification of threats in relation to the loss of confidentiality, integrity, and availability of information and technical systems. Recommendations Solutions and risk mitigation Solutions and mitigation techniques for identified techniques are recommended threats. in order to prevent and mitigate the loss of user and system confidentiality, integrity, and availability. BODY OF THE REPORT Security Architecture of WireGuard WireGuard’s VPN is built around providing privacy and security. The service proposed a security architecture scheme that will allow clients to securely transmit data and authentication traffic from point-to-point, over an intermediary network (Stewart, et al., 155). The following security goals concern the WireGuard developer’s (Tefincom & Co., S.A.’s NordVPN) security as it relates to VPN architecture, which is assumed to work best with WireGuard: 1. Protection of authentication and data traffic (communications), and 2. Client data privacy and protection. These are accomplished by offering encapsulation and tunneling, data packet encryption, IP address privacy, traffic kill-switches when the VPN connection is lost, DNS leak protection if the VPN connection is lost, and no client data retention (NordVPN.com). 3. Endpoint to destination privacy, which is accomplished by offering Onion Over VPN service (Tor), (NordVPN.com). The following security goals concern WireGuard’s intent to surpass other VPN providers’ security measures: 1. Layered encryption techniques are accomplished by offering a cryptokey routing table, faster handshakes, public keys for identification and encryption (versus certificates), and 7 256-bit symmetric encryption key sharing in addition to a Curve25519 ECDH encryption function (Donenfeld, “Next Generation”). 2. Denial-of-service attack mitigation, which is accomplished by offering a cookie reply packet in which the receiver of a handshake message may respond instead with a cookie message containing the result of a MAC computation using the initiator’s IP address (Donenfeld, “Next Generation” 8). 3. A shorter program code than other VPNs, which allows for simpler to auditing, ease in finding vulnerabilities, and a minimal attack surface (Taylor). Threats, Vulnerabilities and Impact if Threats are Exploited 1. Vulnerability: WireGuard offers asymmetric public keys and pre-shared symmetric private key options between peers, but considers key management and distribution outside of its scope. Key management and distribution are assumed by a third party, using a diverse set of mechanisms, only one of which involves certificate authority authentication (Donenfeld, “Next Generation” 3). a. Threat: A client’s private key is generated and managed by a third party, and if that third party is either unknown or untrustworthy, their keys can be compromised. A hacker could gain access to the keys through weaknesses in the third party’s security architecture, or a centralized certificate authority may disregard client privacy and engage in backdoor spying. b. Impact: Hacking and backdoor spying can lead to the decryption of client identity and communication data by using the compromised keys, resulting in the loss of client privacy. 2. Vulnerability: the WireGuard protocol does not own its own operating servers, therefore it relies on its parent operator (the VPN subscription service) third party servers. Reliance on a third party can open the VPN service to uncontrolled