News for hackers. Stuff that matters.

A comment on Tailscale state file encryption no longer enabled by default. Parent comment

Re:Tailscale state file encryption no longer enabled by default by keepamovin on Wednesday January 07, 2026 @10:39PM (#46536916)
Does this mean TS is not FIPS 140-3 now?
[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by tatersolid on Thursday January 08, 2026 @07:44AM (#46540393)
It never was FIPS-approved and likely will never be. The wireguard protocol used by Tailscale uses ChaCha20 for encryption which is not FIPS approved.
[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by keepamovin on Thursday January 08, 2026 @08:53AM (#46540955)
Interesting. What is the FIPS version of wireguard?
[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by cronos on Thursday January 08, 2026 @10:27AM (#46542127)
There are some forks that are not compatible with regular wireguard, for example from wolfssl. Or just classic mTLS.
[ Parent | on HN ]
Re:Tailscale state file encryption no longer enabled by default by tatersolid on Tuesday January 13, 2026 @05:57PM (#46609595)
> What is the FIPS version of wireguard?

IPsec or TLS-based overlays which use AES encryption and NIST-approved ECC curves or (gasp) RSA for key exchange and authentication. They generally suck in comparison with wireguard, which is a clean-sheet modern cryptographic protocol.

[ Parent | on HN ]