C07-TS: Yes
Rationale
WireGuard pads inner packets to 16-byte boundaries before encryption, subject to MTU limits. This reduces exact-length information available for matching packets across an encapsulation boundary.
Assessment method
Pinned dependency/source inspection and official documentation; no runtime test
Source context
Tailscale go.mod and selected wireguard-go dependency
Outstanding qualification
Narrow credit under the criterion allowing partial padding defenses. Timing and coarse length remain visible; no cover schedule, strong anonymity or measured correlation resistance is claimed.
Public sources
- https://raw.githubusercontent.com/tailscale/wireguard-go/e61b6b78110b/device/send.go
- https://raw.githubusercontent.com/tailscale/tailscale/566f89e0fb2aa4b2f1ebf98761e45e62aa5ef225/go.mod
- https://www.wireguard.com/protocol/
- https://tailscale.com/docs/reference/connection-types
- https://raw.githubusercontent.com/tailscale/wireguard-go/e61b6b78110b/device/receive.go
- https://raw.githubusercontent.com/tailscale/wireguard-go/e61b6b78110b/device/send.go
- https://raw.githubusercontent.com/tailscale/wireguard-go/e61b6b78110b/device/timers.go
- https://raw.githubusercontent.com/tailscale/wireguard-go/e61b6b78110b/device/constants.go
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round587.html
- round587-sources.json