WireGuard Automatic Key Rotation With Pro Custodibus

Regular key rotation is a critical component of most every security system, as it allows you to limit the damage of key theft. If an adversary sneaks through all the system’s other defenses, and steals the system’s secret keys, the adversary will be able to access the system through the “front door” until you rotate the system’s keys.

If you know an adversary has broken into a system, rotating the system’s keys would be one of the first things you do to cut off their access. But unfortunately, you often don’t know about the break-in until months afterward — like 15 months in the case of the Solar Winds breach, 5 months in the Equifax breach, or 4 years with the original Marriott breach.

That’s why regular key rotation is standard operating procedure for most security systems — to proactively cut off access to an undiscovered breach.

Most organizations have security policies that require all secrets to be rotated on a regular basis. But because rotating secrets is often a painful, laborious process, this “regular basis” is usually yearly (or longer). The upside of such a policy is that it ensures an adversary won’t have surreptitious access to a system for longer than a year — but the downside is that it allows access for up to a year.

However, when you have the capability to rotate keys automatically, with no manual action necessary, you can rotate keys much more often. With manual rotation, if an organization had a policy that required keys to be rotated as often as monthly, it would be the source of much griping and frequent support calls. But with automatic rotation, monthly rotation is easy and pain-free.

In fact, with automatic rotation, a rotation interval of much, much less is suddenly practical. You can rotate keys weekly, daily, hourly — or even every few minutes! Instead of worrying about how long you have to set the rotation interval in order to stave off revolt from your users and sysadmins, you can can just worry about how short you should make the interval to prevent a stolen key from actually doing real damage.

With WireGuard, you can supplement the security of the public-key pairs that form the basis of WireGuard’s authentication and encryption mechanism with a secret symmetric key, shared by both sides of an individual connection. This is known as a preshared key. While a single key pair is tied to each WireGuard interface — so the same key pair will be used by each of the connections to all the other peers connected to the interface — each connection has its own distinct preshared key.

This can make WireGuard public-key pairs tricky to rotate, since each key change must be coordinated across all the different peers connected to the same interface. However, since each preshared key is used only by a single connection, rotating it is much simpler — you only have to update the key on its two endpoints.

Setting up automatic key rotation with Pro Custodibus is easy! All you have to do is make sure you have the Pro Custodibus agent running on both sides of each connection you want to rotate, and then create a simple key-rotation policy through the Pro Custodibus UI.

An example of this was covered in the WireGuard MFA Guide, but let me show off two common scenarios here: first, where we have a bunch of point-to-point connections, like a bunch of app servers that connect to other infrastructure over WireGuard, like to a database, log system, mail server, and auth server; and second, a central hub (like a traditional VPN or jump host) that connects some internal infrastructure at a site to remote end-user devices.