Secure node state storage

Tailscale node state contains node keys and other sensitive data necessary for identifying the device to your Tailscale network (known as a tailnet) and for encrypting and decrypting traffic to other devices on the tailnet. This document covers how Tailscale encrypts the node state and how to opt out.

Why it matters

Secure node state storage can help protect against a malicious actor copying node state from one device to another, effectively cloning the node. By using platform-specific capabilities, Tailscale ensures node state encrypts at rest, making theft from disk and node cloning more difficult.

Platform support

Secure node state storage implementations vary by platform and Tailscale client version.

Prerequisites

• Refer to platform support for the minimum required Tailscale version for your client platforms.
• On Linux and Windows, your device must have a functioning TPM 2.0 device.

Configure secure node state storage

Configuration of node state storage differs by platform. With Tailscale 1.90.2 or later node state storage encrypts by default on all supported platforms.

Android

Secure node state storage encrypts by default and does not require extra configuration.

Linux

Configure secure node state storage by passing the --encrypt-state flag to tailscaled. Apply the changes by restarting tailscaled.

macOS/iOS/tvOS (from Mac App Store)

Secure node state storage encrypts by default and does not require extra configuration.

macOS standalone

Configure secure node state storage by setting the EncryptState system policy. Apply the changes by restarting tailscaled. Refer to Deploy Tailscale on macOS using MDM for how to configure this on macOS.

Windows

Configure secure node state storage by setting the EncryptState system policy. Apply the changes by restarting tailscaled. Refer to Deploy Tailscale on Windows using MDM for how to configure this on Windows.

Disabling secure node state storage

On supported platforms, disabling secure node state storage will migrate encrypted state to the prior plaintext format.

Device posture attribute

Devices have a node:tsStateEncrypted device posture attibute indicating whether the Tailscale node state encrypts.

Limitations

• If secure node state storage is explicitly enabled on a Linux or Windows device without TPM 2.0 support, Tailscale will fail to start. If not configured explicitly, node state will not be encrypted on devices without TPM 2.0 support, and Tailscale will run normally.
• Enabling secure node state storage can only be done using system policies or CLI flags, not through the graphical settings screen.