Identity management for WireGuard
Identity management for WireGuard
Posted Oct 21, 2022 22:00 UTC (Fri) by wahern (guest, #37304)In reply to: Identity management for WireGuard by tialaramex
Parent article: Identity management for WireGuard
A very strict, narrow answer to the question is: maybe. WireGuard doesn't use EC signatures, e.g. EdDSA or ECDSA. WireGuard packets aren't signed, they're simply encrypted (using a ECDH key exchange scheme), and authenticated by the fact that they decrypt to something sensible. Unlike with ECDSA and standard NIST curve ECDH, which use the same public and private components, Curve25519 schemes don't use the same key for signing as they do for key exchange. An Ed25519 signature key is different from an X25519 key exchange key, including in their public key components. (X25519 is what WireGuard uses, IIRC).
You *can* convert an Ed25519 key to an X25519 key. And you can sort of convert X25519 key back to an Ed25519 key, except there are two possible variants so you need to specify how to deterministically pick one. But because the public key components aren't the same, there's not much value in attempting this, even when ignoring the many reasons why even considering sharing keys this way this is problematic.
Traditionally, using an EC private keys for both key exchange and signatures was frowned upon as early EC schemes were exploitable this way. But I believe Curve25519 schemes like EdDSA and related key exchange schemes are inherently robust to such exploits. That doesn't make doing it any more sensible, though.