Architecture, reliability & security assurance — found from sitemap — Tailscale

Cited by

Facts read from this source

• End to end encryption Report an error

  “Tailscale's architecture provides end-to-end encryption for all network communications, whether devices connect directly or through a relayed connection⎯regardless of whether they're on the same local network or across the globe.”

• Layered encryption Report an error

  “The architecture uses multiple layers of encryption across the control plane and data plane to secure device connections throughout your Tailscale network (known as a tailnet).”

• Control plane tasks Report an error

  “In Tailscale, the control plane performs many tasks, including device coordination, authentication, access control interpretation, and packet filter computation.”

• Control plane protocol Report an error

  “Control plane communication, which includes key exchange and coordinating device connections, employs a custom Noise IK-based protocol with X25519 as described in RFC7748.”

• Control plane tls option Report an error

  “While it can operate directly over plain TCP in environments that allow it, it also supports being wrapped in TLS when necessary for compatibility or additional security requirements.”

• Data plane wireguard Report an error

  “Tailscale's data plane uses WireGuard as its primary mechanism to encrypt communication between Tailscale devices.”

• Derp fallback Report an error

  “Tailnet devices start out using a DERP server to establish a connection, then transition to a direct connection if possible. If a direct connection isn't possible, devices fall back to a relayed connection using DERP servers.”

• Derp no plaintext access Report an error

  “DERP servers never access your unencrypted data; they only handle WireGuard packets that are already encrypted.”

• Derp client authentication Report an error

  “The connection between devices and DERP servers are authenticated using a NaCl box construction on top of TLS to verify that clients own their claimed WireGuard keys.”

• Nat traversal protocol Report an error

  “Tailscale's NAT traversal engine implements a custom UDP protocol for path discovery, using NaCl box for authenticated encryption. This protocol operates separately from the main WireGuard data plane, and can only influence the efficiency of connections, not the security of the data they carry.”

• Node state encryption Report an error

  “Tailscale devices can be configured to secure node state storage by using encryption.”

• Lets encrypt certificates Report an error

  “Tailscale assists you with provisioning TLS certificates from Let's Encrypt using hostnames within your tailnet's MagicDNS domain.”

• Tailnet lock signatures Report an error

  “The Tailnet Lock feature uses ED25519 signatures for authentication.”

• Tailnet lock control Report an error

  “it ensures that only devices authorized by designated approvers (which are not under Tailscale's control) can communicate with devices in your tailnet.”

• Log transport tls Report an error

  “All Tailscale log data is sent over TLS without additional authentication or encryption.”

• Tls implementation Report an error

  “Tailscale's TLS (Transport Layer Security) implementation builds upon the Go crypto/tls package, requiring a minimum of TLS 1.2 while supporting TLS 1.3.”

• Aead ciphers Report an error

  “The AEAD implementation can dynamically choose between AES-128-GCM or ChaCha20-Poly1305 based on the availability of hardware acceleration for AES operations.”

• Forward secrecy Report an error

  “The system uses the default cipher suite selection from the Go implementation, which includes ECDHE for forward secrecy and AEAD schemes.”

• Fips status Report an error

  “Tailscale's cryptographic implementations are not FIPS compliant, and several of the primitive choices (including Curve25519, XSalsa20, ChaCha20-Poly1305, and the Noise and WireGuard protocols) cannot be made compliant under current FIPS standards.”

• Crypto review Report an error

  “While these implementations have been reviewed by cryptographers and are considered secure⎯in many cases, providing superior security to FIPS-approved alternatives⎯this might be a consideration for organizations requiring FIPS compliance.”

• Fips docs reference Report an error

  “For more information, refer to Tailscale FedRAMP and FIPS-140 considerations.”

Scores citing this record

• The DevOps Engineer Access model & connectivity
• The DevOps Engineer Architecture, reliability & security assurance
• The IT Lead Access model & connectivity
• The IT Lead Architecture, reliability & security assurance
• The MSP Technician Access model & connectivity
• The MSP Technician Architecture, reliability & security assurance
• The Operations Manager Access model & connectivity
• The Operations Manager Architecture, reliability & security assurance
• The Information Security Officer Access model & connectivity
• The Information Security Officer Architecture, reliability & security assurance
• The Skeptic Access model & connectivity
• The Skeptic Architecture, reliability & security assurance