saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/deploying-tailscale-for-zero-trust-vpn/references/standards.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

1.9 KiB
Raw Blame History

Standards Reference: Tailscale Zero Trust VPN

Protocol Standards

WireGuard Protocol

  • Encryption: ChaCha20 for symmetric encryption
  • Key Exchange: Curve25519 for Diffie-Hellman
  • MAC: Poly1305 for message authentication
  • Hashing: BLAKE2s for hashing
  • Framework: Noise Protocol Framework for key negotiation

NIST SP 800-207: Zero Trust Architecture

  • Tailscale implements identity-aware proxying (Section 3.2.2)
  • End-to-end encryption satisfies data-in-transit requirements
  • ACL-based access control implements least privilege access
  • Device identity via WireGuard keys maps to device trust

NIST SP 800-77: Guide to IPsec VPNs

  • WireGuard provides alternative to IPsec with reduced complexity
  • Tailscale automates key distribution and NAT traversal
  • Mesh topology eliminates single point of failure

Tailscale Security Model

Identity Layer

  • Authentication via OIDC-compatible identity providers
  • SSO integration with Okta, Azure AD, Google Workspace, GitHub
  • MFA enforcement through identity provider policies
  • Key expiry forces periodic re-authentication

Network Layer

  • Default deny ACL policy (zero trust)
  • Per-connection authorization based on identity and tags
  • No implicit trust based on network location
  • All traffic encrypted with WireGuard (256-bit keys)

Device Layer

  • Unique WireGuard key pair per device
  • Device authorization required before network access
  • Network Lock prevents unauthorized node addition
  • Ephemeral nodes for temporary workloads

Compliance Considerations

SOC 2

  • End-to-end encryption for data in transit
  • ACL-based access control for authorization
  • Audit logging for all connection events
  • Key management through coordination server

GDPR

  • Data minimization: Tailscale only routes traffic, does not inspect
  • Encryption: All traffic encrypted end-to-end
  • Self-hosted option (Headscale) for data sovereignty
  • Log retention configurable per organization policy