Re: Rolling keys without service interuption

[Ferris Ellis <ferris@ferrisellis.com>]

Jason,

Awesome! That=E2=80=99s exactly what I needed :) I=E2=80=99ll try it out and=
 post a follow up if I have any issues.

Cheers,
Ferris

> On Dec 2, 2017, at 8:31 AM, Jason A. Donenfeld <Jason@zx2c4.com> wrote:
>=20
> Hi Ferris,
>=20
> Firstly, WireGuard already has forward secrecy, which means every new
> session (negotiated every 2 minutes) has fresh keys that are
> forgotten, so old recorded traffic cannot be compromised.
>=20
> It sounds like, however, you want to rotate the long term static
> "identity" keys. This is possible to do gracefully. If you change the
> private key of an interface, it won't actually be used until the next
> handshake occurs, which means you can rollover gracefully. Likewise
> you can add new peers (via public keys) dynamically at runtime. Moving
> a distinct allowed IP from one peer to another is an atomic operation
> as well.
>=20
> Hope this helps!
>=20
> Regards,
> Jason