Sage Infrastructure Solutions Group IncSage Infrastructure Solutions Group IncLoading…

Sage Infrastructure Solutions Group Inc

FIPS mode

FIPS mode protects the traffic between NullWard nodes, and between NullWard and the connectors of application tunnels, with FIPS 140-3 validated cryptography. It needs NullWard 0.6.97 or later.

What it does

NullWard's cluster mesh and application tunnels run over WireGuard. WireGuard's algorithms (ChaCha20-Poly1305, Curve25519, BLAKE2s) aren't FIPS-approved, and the protocol can't use others. FIPS mode keeps WireGuard as the outer layer and protects the traffic inside it with approved cryptography from the Go Cryptographic Module v1.0.0 (CMVP certificate #5247):

  • Between NullWard nodes: cluster connections use TLS 1.3, and cluster packets are sealed with AES-256-GCM.
  • Between NullWard and a tunnel's connector: for tunnels in FIPS mode, all traffic uses TLS 1.3. That covers requests (including gRPC, WebSockets and TLS passthrough), health checks, heartbeats and connector updates.

Both ends verify each other's keys, which travel the same trusted paths as the WireGuard keys. Nothing is sent in plaintext to a tunnel in FIPS mode. If its connector isn't ready, requests through the tunnel fail until it is.

With FIPS mode on, every NullWard node and every FIPS tunnel's connector runs its cryptography in FIPS mode. That has effects beyond the tunnels:

  • Client HTTPS uses only approved algorithms: TLS 1.2 and 1.3 with AES-GCM and P-256 or P-384 (or the post-quantum hybrid X25519MLKEM768). ChaCha20, plain X25519 and TLS 1.1 are refused. Current browsers and clients all support the approved set.
  • HTTP/3 is turned off: QUIC's packet encryption doesn't use the validated module. Clients use HTTP/2 and HTTP/1.1 over TLS.

What this is: NullWard's cluster and tunnel traffic protected by a FIPS 140-3 validated module. What it isn't: a FIPS 140 validation of NullWard itself.

Turn on FIPS mode

  1. Go to Settings › Security and turn on FIPS mode.
  2. Every node restarts itself in FIPS mode, one at a time. A node waits until the nodes before it have switched and have been back for 90 seconds, so connectors reconnect before the next node restarts and the cluster keeps serving. A standalone node restarts within about 15 seconds.
  3. Follow progress on the same page: This node and Cluster nodes in FIPS mode (for example 3 of 3). The Cluster page shows a FIPS badge on each node in FIPS mode.

While the switch is in progress, nodes already in FIPS mode protect their traffic with each other, and still talk to the others as before.

To join a node to a FIPS cluster, turn on FIPS mode on that node first and let it restart. Join tokens of a FIPS cluster need an https:// admin URL, because the join carries the cluster's keys.

Turn on FIPS mode for a tunnel

FIPS mode is set per tunnel, so connectors can be updated and switched one at a time. It needs FIPS mode on for NullWard and connector 0.6.97 or later (generic or Kubernetes).

  1. Update the connector if needed. The tunnels list shows its version.
  2. On the Tunnels page, turn on the tunnel's FIPS switch.
  3. On its next heartbeat (within 30 seconds), the connector restarts itself in FIPS mode and switches to TLS. The column then shows protected. Until then, the column shows why there's no traffic yet, and requests through the tunnel fail rather than going out unprotected.

Every NullWard node applies the change within a second or so, as the setting replicates.

Windows connectors can't restart themselves in FIPS mode. Set the environment variable GODEBUG=fips140=on for the connector's service and restart it.

Kubernetes connectors: the connector keeps its TLS keys in Secrets in its own namespace. After upgrading to 0.6.97, apply the chart's CRD again (kubectl apply -f crds/nullwardtunnel.yaml; helm upgrade doesn't update CRDs) and run helm upgrade, which adds the permission to manage those Secrets.

Connector keys

Each connector has its own TLS key, which NullWard records from the connector's first heartbeat over the tunnel. It is never silently replaced. If you reinstall a connector (new key), click reset key under the tunnel's FIPS switch; its next heartbeat registers the new key.

Turn FIPS mode off

Turn off FIPS mode on each tunnel first, then turn it off in Settings › Security. The nodes restart out of FIPS mode one at a time, and cluster traffic then relies on WireGuard only. Connectors stay in FIPS mode until their next restart, which does no harm.