Does this mean TS is not FIPS 140-3 now?

tatersolid · 2026-01-08T12:44:40 1767876280

It never was FIPS-approved and likely will never be. The wireguard protocol used by Tailscale uses ChaCha20 for encryption which is not FIPS approved.

keepamovin · 2026-01-08T13:53:37 1767880417

Interesting. What is the FIPS version of wireguard?

cronos · 2026-01-08T15:27:22 1767886042

There are some forks that are not compatible with regular wireguard, for example from wolfssl. Or just classic mTLS.

tatersolid · 2026-01-13T22:57:50 1768345070

> What is the FIPS version of wireguard?

IPsec or TLS-based overlays which use AES encryption and NIST-approved ECC curves or (gasp) RSA for key exchange and authentication. They generally suck in comparison with wireguard, which is a clean-sheet modern cryptographic protocol.