tailcat: separate node and disco keys

Like Tailscale itself, use separate node and disco keys. Tailcat had
lazily reused the node key as its disco key as an early implementation
shortcut, and that shortcut was not cleaned up before release.

Because disco frames expose the disco public key on direct UDP paths,
reusing it also exposed the node public key embedded in the unlisted
connection token. Derive an independent disco key, include its public
half in new tokens, and reject legacy tokens when connecting.

Thanks to Heyang Zhou (https://x.com/heyang_zhou) for the report!

Reported-by: Heyang Zhou (@losfair)

Author: bradfitz

README.md

@@ -451,11 +451,12 @@ ConnBlob internally). It looks like `tcXYZ...` and is a `"tc"` prefix
 followed by base64-encoded [CBOR](https://cbor.io/) containing:
 
 - The server's WireGuard public key (Curve25519, 32 bytes)
+- A separate path-discovery public key (Curve25519, 32 bytes)
 - DERP info. Either:
   1. a small integer referencing one of the default [Tailscale-run tailcat servers](https://tailcat.dev/derpmap.json), or
   2. full DERP server metadata, to either use a custom DERP server, or to avoid the client needing a potential round-trip to fetch the latest DERP map (the server's `--full-address` flag and the `tailcat resolve` subcommand produce this form)
 
-A typical token with just an integer region ID is around 50 bytes. With embedded
+A typical token with just an integer region ID is around 95 bytes. With embedded
 DERP node details it's longer but self-contained.
 
 ### Network stack
@@ -483,8 +484,10 @@ without the control plane.
    It then waits for clients.
 
 2. **Client parses the token** to learn the server's public key and
-   DERP region. It generates its own ephemeral keypair and connects to
-   the same DERP relay.
+   path-discovery key, plus its DERP region. It generates its own ephemeral
+   keypair and connects to the same DERP relay. The separate path-discovery
+   key can appear in cleartext direct-path disco frames without revealing the
+   WireGuard public key that acts as the unlisted connection capability.
 
 3. **Discovery handshake.** The client sends a "**Meow**" ping message
   to the server through the

cmd/tailcat/tailcat.go

@@ -736,7 +736,7 @@ func server(logf logger.Logf) {
 		clearUnnecessaryRegionFields(reg)
 		fmt.Fprintf(os.Stderr, "# Selected bootstrap relay region %v, %v\n", reg.RegionID, reg.RegionName)
 
-		ci = &tailcat.ConnInfo{ServerPublic: tailcat.NodePublic{NodePublic: priv.Public()}}
+		ci = new(tailcat.ConnInfo)
 		if embed {
 			ci.Region = []*tailcfg.DERPRegion{reg}
 		} else {
@@ -750,6 +750,8 @@ func server(logf logger.Logf) {
 			Region:       []*tailcfg.DERPRegion{reg},
 		}
 	}
+	ci.ServerPublic = tailcat.NodePublic{NodePublic: priv.Public()}
+	ci.ServerDiscoPublic = tailcat.DiscoPublicForNode(priv)
 	connStr := ci.ConnBlob()
 
 	s := &tailcat.Server{Key: priv, Logf: logf, Region: reg}

tailcat.go

@@ -7,7 +7,7 @@
 //
 // A [Server] listens for incoming clients via a DERP relay. Clients discover
 // the server through a compact [ConnBlob] (connection blob) that encodes the
-// server's public key and DERP region. DERP is used only for the initial
+// server's WireGuard and path-discovery public keys and DERP region. DERP is used only for the initial
 // bootstrap; once both sides learn each other's endpoints, Tailscale's
 // magicsock layer upgrades to a direct peer-to-peer UDP path whenever possible,
 // just like the normal Tailscale data plane. DERP remains available as a
@@ -33,6 +33,8 @@ package tailcat
 import (
 	"cmp"
 	"context"
+	"crypto/hmac"
+	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
@@ -136,11 +138,16 @@ type expandForServer struct{}
 // [ConnInfo]. A typical ConnBlob looks like "tcomFwWC…".
 type ConnBlob string
 
-// ConnInfo describes how to reach a server: its public key and which DERP
-// relay region to use. It is serialized into a [ConnBlob] for exchange,
+// ConnInfo describes how to reach a server: its WireGuard and path-discovery
+// public keys and which DERP relay region to use. It is serialized into a [ConnBlob] for exchange,
 // via the wire types in wire.go.
 type ConnInfo struct {
 	ServerPublic NodePublic // a key.NodePublic
+	// ServerDiscoPublic is the server's public key for path discovery.
+	// It is deliberately independent from ServerPublic: disco packets carry
+	// this key in cleartext on direct UDP paths, while ServerPublic is the
+	// unguessable part of the server's connection address.
+	ServerDiscoPublic DiscoPublic // a key.DiscoPublic
 
 	// Region, if non-empty, lists the regions of a DERPMap.
 	// Either Region or RegionID must be set. If Region is set
@@ -167,6 +174,31 @@ type NodePublic struct {
 	key.NodePublic
 }
 
+// DiscoPublic is a wrapper around key.DiscoPublic that uses its raw 32-byte
+// representation in connection blobs.
+type DiscoPublic struct {
+	key.DiscoPublic
+}
+
+// Equal reports whether a and b represent the same disco public key.
+func (a DiscoPublic) Equal(b DiscoPublic) bool {
+	return a.DiscoPublic == b.DiscoPublic
+}
+
+// MarshalBinary implements encoding.BinaryMarshaler.
+func (p DiscoPublic) MarshalBinary() ([]byte, error) {
+	return p.DiscoPublic.AppendTo(nil), nil
+}
+
+// UnmarshalBinary implements encoding.BinaryUnmarshaler.
+func (p *DiscoPublic) UnmarshalBinary(x []byte) error {
+	if len(x) != key.DiscoPublicRawLen {
+		return fmt.Errorf("invalid disco public key length %d, want %d", len(x), key.DiscoPublicRawLen)
+	}
+	p.DiscoPublic = key.DiscoPublicFromRaw32(go4mem.B(x))
+	return nil
+}
+
 // MarshalBinary implements encoding.BinaryMarshaler for CBOR serialization,
 // encoding the raw 32-byte key without the "nodekey:" text prefix.
 func (p NodePublic) MarshalBinary() ([]byte, error) {
@@ -203,6 +235,7 @@ func NewPrivateKey() *PrivateKey {
 		Private: key.NewNode(),
 	}
 	ret.Public.ServerPublic = NodePublic{ret.Private.Public()}
+	ret.Public.ServerDiscoPublic = DiscoPublic{discoPrivateForNode(ret.Private).Public()}
 	return ret
 }
 
@@ -211,16 +244,17 @@ func NewPrivateKey() *PrivateKey {
 // but there's no controlclient involved, because there's
 // no control plane.
 type locoBackend struct {
-	sys        tsd.System
-	priv       key.NodePrivate
-	pub        key.NodePublic
-	addr       netip.Addr
-	addrPrefix netip.Prefix
-	ns         *netstack.Impl
-	dm         *tailcfg.DERPMap
-	logf       logger.Logf
-	serverPub  key.NodePublic // non-zero if we're a client (server's public key)
-	isServer   bool
+	sys            tsd.System
+	priv           key.NodePrivate
+	pub            key.NodePublic
+	addr           netip.Addr
+	addrPrefix     netip.Prefix
+	ns             *netstack.Impl
+	dm             *tailcfg.DERPMap
+	logf           logger.Logf
+	serverPub      key.NodePublic  // non-zero if we're a client (server's public key)
+	serverDiscoPub key.DiscoPublic // non-zero if we're a client (server's disco key)
+	isServer       bool
 
 	// discoPublic returns the node's disco public key, memoized to
 	// avoid redoing the curve25519 derivation for every client that
@@ -675,9 +709,7 @@ func newLocoBackend(priv key.NodePrivate) *locoBackend {
 		addr:       addr,
 		addrPrefix: addrPrefix,
 	}
-	lb.discoPublic = sync.OnceValue(func() key.DiscoPublic {
-		return nodePrivateAsDiscoPrivate(lb.priv).Public()
-	})
+	lb.discoPublic = sync.OnceValue(func() key.DiscoPublic { return discoPrivateForNode(lb.priv).Public() })
 	return lb
 }
 
@@ -689,6 +721,7 @@ func (lb *locoBackend) connBlob() ConnBlob {
 	}
 	var ci ConnInfo
 	ci.ServerPublic = NodePublic{lb.pub}
+	ci.ServerDiscoPublic = DiscoPublic{lb.discoPublic()}
 	for _, r := range lb.dm.Regions {
 		ci.Region = append(ci.Region, r)
 	}
@@ -712,6 +745,9 @@ func (ci *ConnInfo) ConnBlob() ConnBlob {
 		ServerPublic: ci.ServerPublic,
 		RegionID:     ci.RegionID,
 	}
+	if !ci.ServerDiscoPublic.IsZero() {
+		w.ServerDiscoPublic = &ci.ServerDiscoPublic
+	}
 	for _, r := range ci.Region {
 		wr := wireRegionOf(r)
 
@@ -806,6 +842,9 @@ func ParseConnBlob(cb ConnBlob) (ConnInfo, error) {
 		ServerPublic: w.ServerPublic,
 		RegionID:     w.RegionID,
 	}
+	if w.ServerDiscoPublic != nil {
+		ci.ServerDiscoPublic = *w.ServerDiscoPublic
+	}
 	for _, wr := range w.Region {
 		ci.Region = append(ci.Region, wr.derpRegion())
 	}
@@ -1180,7 +1219,7 @@ func (b *locoBackend) advertiseEndpoints() {
 		return
 	}
 	payload := (&disco.CallMeMaybe{MyNumber: eps}).AppendMarshal(nil)
-	discoPriv := nodePrivateAsDiscoPrivate(b.priv)
+	discoPriv := discoPrivateForNode(b.priv)
 	mc := b.sys.MagicSock.Get()
 	regionID := b.derpRegionID()
 	for _, p := range peers {
@@ -1261,7 +1300,7 @@ func (lb *locoBackend) Start() error {
 			Name:       "server.tailcat.",
 			User:       100,
 			Key:        lb.serverPub,
-			DiscoKey:   nodePublicAsDiscoPublic(lb.serverPub),
+			DiscoKey:   lb.serverDiscoPub,
 			Addresses:  []netip.Prefix{serverAddrPrefix},
 			AllowedIPs: []netip.Prefix{serverAddrPrefix, allIPv6},
 			HomeDERP:   derpRegion,
@@ -1423,13 +1462,13 @@ func createEngine(logf logger.Logf, lb *locoBackend) (err error) {
 	if lb.isServer {
 		conf.DERPAppName = "tailcat-server"
 	}
-	// Both sides force their disco key to be derived from their node
-	// key. For the server, that lets clients predict its disco key
-	// from the ConnBlob without extra round trips. And knowing our own
-	// disco private key is what lets either side seal the
+	// Both sides deterministically derive a separate disco key from their
+	// node private key. The public disco key, unlike the node key, is safe to
+	// expose in direct-path disco frames. Knowing our own disco private key
+	// is what lets either side seal the
 	// call-me-maybe messages that advertise our UDP endpoints (see
 	// locoBackend.advertiseEndpoints).
-	conf.ForceDiscoKey = nodePrivateAsDiscoPrivate(lb.priv)
+	conf.ForceDiscoKey = discoPrivateForNode(lb.priv)
 	netns.SetEnabled(false)
 	e, err := wgengine.NewUserspaceEngine(logf, conf)
 	if err != nil {
@@ -1524,11 +1563,15 @@ func (c *Client) initLocked() error {
 	if err != nil {
 		return err
 	}
+	if ci.ServerDiscoPublic.IsZero() {
+		return errors.New("legacy server address lacks a separate disco key; generate a new address with an updated tailcat server")
+	}
 
 	lb := newLocoBackend(c.nodeKeyLocked())
 	lb.logf = logf
 	lb.dm = &tailcfg.DERPMap{}
 	lb.serverPub = ci.ServerPublic.NodePublic
+	lb.serverDiscoPub = ci.ServerDiscoPublic.DiscoPublic
 
 	sys := &lb.sys
 	bus := eventbus.New()
@@ -1876,18 +1919,25 @@ func (s *Server) Status() *ipnstate.Status {
 	return s.lb.Status()
 }
 
-// nodePrivateAsDiscoPrivate converts a NodePrivate to a DiscoPrivate by
-// reusing the same raw key bytes. This is used in tailcat where the server
-// uses its node key as the disco key.
-func nodePrivateAsDiscoPrivate(k key.NodePrivate) key.DiscoPrivate {
-	raw := k.Raw32()
-	return key.DiscoPrivateFromRaw32(go4mem.B(raw[:]))
-}
-
-// nodePublicAsDiscoPublic converts a NodePublic to a DiscoPublic by
-// reusing the same raw key bytes. This is used in tailcat where the
-// server's node public key doubles as its disco public key.
-func nodePublicAsDiscoPublic(k key.NodePublic) key.DiscoPublic {
+// discoPrivateForNode deterministically derives a path-discovery key from a
+// node private key. Keeping the two public keys unlinkable is a security
+// boundary: disco frames expose the disco public key on the local network,
+// while knowledge of the node public key grants access to an open server.
+func discoPrivateForNode(k key.NodePrivate) key.DiscoPrivate {
 	raw := k.Raw32()
-	return key.DiscoPublicFromRaw32(go4mem.B(raw[:]))
+	mac := hmac.New(sha256.New, raw[:])
+	mac.Write([]byte("github.com/tailscale/tailcat disco key v1"))
+	discoRaw := mac.Sum(nil)
+	// Canonicalize the Curve25519 scalar, as key.NewDisco does.
+	discoRaw[0] &= 248
+	discoRaw[31] &= 127
+	discoRaw[31] |= 64
+	return key.DiscoPrivateFromRaw32(go4mem.B(discoRaw))
+}
+
+// DiscoPublicForNode returns the path-discovery public key derived from a
+// node private key. Code constructing a [ConnInfo] directly must include it
+// as ConnInfo.ServerDiscoPublic.
+func DiscoPublicForNode(k key.NodePrivate) DiscoPublic {
+	return DiscoPublic{discoPrivateForNode(k).Public()}
 }

tailcat_test.go

@@ -13,6 +13,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
+	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
@@ -424,6 +425,51 @@ func TestConnBlob(t *testing.T) {
 	}
 }
 
+func TestConnBlobSeparateDiscoKey(t *testing.T) {
+	priv := key.NewNode()
+	discoPub := DiscoPublicForNode(priv)
+	ci := ConnInfo{
+		ServerPublic:      NodePublic{priv.Public()},
+		ServerDiscoPublic: discoPub,
+		RegionID:          10,
+	}
+	got, err := ParseConnBlob(ci.ConnBlob())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !got.ServerDiscoPublic.Equal(discoPub) {
+		t.Fatalf("disco public key changed in round trip: got %v, want %v", got.ServerDiscoPublic, discoPub)
+	}
+	if got.ServerDiscoPublic.Raw32() == got.ServerPublic.Raw32() {
+		t.Fatal("server disco public key exposes the server node public key")
+	}
+	if again := DiscoPublicForNode(priv); !again.Equal(discoPub) {
+		t.Fatal("disco key derivation is not stable")
+	}
+	// Reproduce the report's reconstruction strategy: treating the public
+	// key visible in a direct-path disco frame as the server node key must
+	// not recover the connection address.
+	reconstructed := (&ConnInfo{
+		ServerPublic: NodePublic{key.NodePublicFromRaw32(mem.B(discoPub.AppendTo(nil)))},
+		RegionID:     ci.RegionID,
+	}).ConnBlob()
+	if reconstructed == ci.ConnBlob() {
+		t.Fatal("disco public key can reconstruct the connection address")
+	}
+}
+
+func TestClientRejectsLegacyConnBlob(t *testing.T) {
+	legacy := (&ConnInfo{
+		ServerPublic: NodePublic{key.NewNode().Public()},
+		RegionID:     10,
+	}).ConnBlob()
+	c := NewClient(legacy)
+	_, err := c.Ping(context.Background())
+	if err == nil || !strings.Contains(err.Error(), "legacy server address") {
+		t.Fatalf("Ping error = %v; want legacy address rejection", err)
+	}
+}
+
 func TestParseConnBlobMalformedPublicKey(t *testing.T) {
 	for name, keyBytes := range map[string][]byte{
 		"short": make([]byte, key.NodePublicRawLen-1),
@@ -458,6 +504,27 @@ func TestParseConnBlobMalformedPublicKey(t *testing.T) {
 	}
 }
 
+func TestParseConnBlobMalformedDiscoPublicKey(t *testing.T) {
+	for name, keyBytes := range map[string][]byte{
+		"short": make([]byte, key.DiscoPublicRawLen-1),
+		"long":  make([]byte, key.DiscoPublicRawLen+1),
+	} {
+		t.Run(name, func(t *testing.T) {
+			raw, err := cbor.Marshal(map[string][]byte{
+				"p": key.NewNode().Public().AppendTo(nil),
+				"k": keyBytes,
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			cb := ConnBlob("tc" + base64.RawURLEncoding.EncodeToString(raw))
+			if _, err := ParseConnBlob(cb); err == nil {
+				t.Fatal("ParseConnBlob unexpectedly accepted malformed disco public key")
+			}
+		})
+	}
+}
+
 // TestFetchDERPMapMemoryCache verifies the default in-memory DERP map
 // cache: a second fetch of the same URL within the freshness window
 // makes no network request.

web/main_js.go

@@ -88,7 +88,7 @@ func tailcatListen(this js.Value, args []js.Value) any {
 		if keyJSON == "" {
 			// Pin the picked region so a persisted key keeps the
 			// same address across page loads.
-			pk.Public = tailcat.ConnInfo{ServerPublic: pk.Public.ServerPublic, RegionID: reg.RegionID}
+			pk.Public.RegionID = reg.RegionID
 		}
 		blob := pk.Public.ConnBlob()
 		keyOut, err := json.Marshal(pk)

wire.go

@@ -24,9 +24,10 @@ import (
 
 // wireConnInfo is the wire form of [ConnInfo].
 type wireConnInfo struct {
-	ServerPublic NodePublic    `cbor:"p" json:"ServerPublic"`
-	Region       []*wireRegion `cbor:"r,omitempty" json:"Region,omitempty"`
-	RegionID     int           `cbor:"i,omitempty" json:"RegionID,omitempty"`
+	ServerPublic      NodePublic    `cbor:"p" json:"ServerPublic"`
+	ServerDiscoPublic *DiscoPublic  `cbor:"k,omitempty" json:"ServerDiscoPublic,omitempty"`
+	Region            []*wireRegion `cbor:"r,omitempty" json:"Region,omitempty"`
+	RegionID          int           `cbor:"i,omitempty" json:"RegionID,omitempty"`
 }
 
 // wireRegion is the wire form of [tailcfg.DERPRegion].

wire_test.go

@@ -21,6 +21,7 @@ import (
 // ConnBlob wire format.
 var wireFieldNames = map[string]string{
 	"p": "ServerPublic",
+	"k": "ServerDiscoPublic",
 	"r": "Region",
 	"i": "RegionID",
 	"c": "RegionCode",