Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard: Next Generation Secure Kernel Network Tunnel

fosdem.org

Post reply on HN
Print view View original

41–44 of 44 posts

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#41

Post by wolf550e »

sargun wrote: post #39
tptacek wrote: post #28

Earlier quoted context omitted.

You implemented an elliptic curve scalar multiplication in BPF bytecode? Why? Which curve?

So, for one of the implementations, yes, we implemented Curve25519 inside of the Kernel. Basically, every node was pushed into a map with the association of IP/Port to key data. At the reception of a packet, if we didn't have a key, we'd punt the packet to userspace, asking it to do an exchange. For some reason -- That I forget, we ended up putting the entire key into each packet. I think that when the "exchange" hap…

Has a cryptographer ever looked at the protocol you invented? Maybe doing the asymmetric crypto on every packet is just a harmless performance problem that, but maybe you invented something insecure. Or is the protocol strictly from the spec (NaCl?) and just the implementation strange?

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#42

Post by sargun »

wolf550e wrote: post #41
sargun wrote: post #39

Earlier quoted context omitted.

So, for one of the implementations, yes, we implemented Curve25519 inside of the Kernel. Basically, every node was pushed into a map with the association of IP/Port to key data. At the reception of a packet, if we didn't have a key, we'd punt the packet to userspace, asking it to do an exchange. For some reason -- That I forget, we ended up putting the entire key into each packet. I think that when the "exchange" hap…

Has a cryptographer ever looked at the protocol you invented? Maybe doing the asymmetric crypto on every packet is just a harmless performance problem that, but maybe you invented something insecure. Or is the protocol strictly from the spec (NaCl?) and just the implementation strange?

No, the project never got that far. I did discuss with a security researcher though, and it was secure, but it lacked features like PFS, and the handshake protocol could leak information.

In addition, using "pure" random nonces has all sorts of interesting problems.

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#43

Post by dguido »

tptacek wrote: post #27
dguido wrote: post #4

If you want a reliable VPN you can use today on nearly every platform, try Algo VPN. It uses simplifies using IPSEC so that anyone who can run a few command line scripts can use it. https://github.com/trailofbits/algo It's great that someone is working on what comes next after IPSEC, but the platform support for everyone won't come any time soon. If you need a VPN today, Algo is your best answer.

I like Algo a lot, but find it approximately as hard to recommend an IPSEC head-end to a sensitive network as I do recommending OpenVPN, and OpenVPN has better clients. Algo makes sense to me as the kind of VPN I set up to run traffic through when I travel, but not for protecting networks. I'm not convinced that the problem of replacing VPN protocols is so difficult that we should get comfortable with IPSEC. We're re…

I'll add WireGuard when it gets better client support. I'm not tied to IPSEC.

The core values of Algo are making self-hosting and initial setup easy and reliable.

Re: WireGuard: Next Generation Secure Kernel Network Tunnel

#44

Post by dguido »

sandGorgon wrote: post #8
dguido wrote: post #4

If you want a reliable VPN you can use today on nearly every platform, try Algo VPN. It uses simplifies using IPSEC so that anyone who can run a few command line scripts can use it. https://github.com/trailofbits/algo It's great that someone is working on what comes next after IPSEC, but the platform support for everyone won't come any time soon. If you need a VPN today, Algo is your best answer.

What is a good hosted ipsec vpn? also is there built in support for networkmanager?

The entire point of Algo is to avoid using a hosted VPN because they're awesomely insecure. More here:

https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa

https://gist.github.com/joepie91/5a9909939e6ce7d09e29

Post reply on HN