C03-TS: No
Rationale
On the selected direct UDP path, established WireGuard packets expose their message type, receiver index and counter. Encrypting the inner packet does not conceal all protocol control fields.
Assessment method
Primary documentation and explicit architectural inference; no runtime test
Source context
Tailscale service model and WireGuard protocol
Outstanding qualification
DERP TLS can hide these fields from a passive carrier on that segment; it does not remove the direct-path counterexample in this selected profile.
Public sources
- https://www.wireguard.com/protocol/
- https://tailscale.com/docs/features/access-control
- https://tailscale.com/docs/concepts/tailscale-ip-addresses
- https://tailscale.com/docs/concepts/control-data-planes
- https://tailscale.com/docs/reference/connection-types
- https://tailscale.com/docs/features/site-to-site
- https://www.wireguard.com/protocol/
- https://www.wireguard.com/
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round585.html
- round585-sources.json