Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard is submitted for Linux kernel inclusion

marc.info

Post reply on HN
Print view View original

161–170 of 189 posts

Re: WireGuard is submitted for Linux kernel inclusion

#161

Post by zx2c4 »

craftyguy wrote: post #158
zx2c4 wrote: post #118

Earlier quoted context omitted.

> The only downside I've notice is slightly increased battery consumption on my phone, but that's to be expected (it uses approximately 5% of the battery per day). Note that if you run a phone that has the WireGuard kernel module (rather than the userspace implementation), battery usage winds up being basically nil in my tests. As for the userspace fallback, we expect performance (and hence battery life) to increase…

>Note that if you run a phone that has the WireGuard kernel module I wonder if LineageOS plans to include this module..

I've been working on it with them actually. We'll see where that goes.

Re: WireGuard is submitted for Linux kernel inclusion

#162

Post by tptacek »

auslander wrote: post #115
neilalexander wrote: post #102

Earlier quoted context omitted.

It's pretty good if you have two devices that support the same proposed ciphers and don't implement other non-standard behaviour (I'm looking at you, Juniper). It's eye-bleed otherwise.

Why Juniper? I would not trust proprietary stuff over Strongswan, even if it worked correctly :) And Apple IKEv2 native clients work fine too.

strongSwan is literally 2 orders of magnitude more code than WireGuard, and for all that you get 1990s cryptography. Why would you trust it at all?

Re: WireGuard is submitted for Linux kernel inclusion

#163

Post by chasil »

tialaramex wrote: post #155
chasil wrote: post #145

Earlier quoted context omitted.

The docs do say: "Finally, WireGuard is cryptographically opinionated. It intentionally lacks cipher and protocol agility. If holes are found in the underlying primitives, all endpoints will be required to update." ECDH 25519 will fall like a house of cards to a capable quantum computer. Since Wireguard is already entirely DJB, the introduction of a tiny bit of agility with one of Bernstein's submissions (Classic McE…

If you believe that demanding agility is "far from unreasonable" I strongly recommend taking that line rather than insisting people should use relatively untried shiny new toys out of fear of a monster that may not actually be under their beds. I don't know that WireGuard's author will agree, but you at least have a coherent argument that makes sense. Replacing 25519 with NTRU because you're terrified of a bogeyman (…

I never said "instead of," although I can see in hindsight why it might be seen that way. I should have been more clear.

Wireguard could have used P521 and AES-GCM with similar security, but it would be slower and equally vulnerable.

Re: WireGuard is submitted for Linux kernel inclusion

#164

Post by eximius »

zx2c4 wrote: post #105
eximius wrote: post #77

Earlier quoted context omitted.

The lack of a forum for discussion is also a problem. (Or maybe I'm just spoiled by github.) There is one feature that I want that should be trivial to add that I don't know how to voice it. There is an AllowIPs config directive, but not an ExcludeIPs directive.

There's the mailing list: https://lists.zx2c4.com/mailman/listinfo/wireguard And there's the IRC channel: #wireguard on Freenode And in both of these there is quite a bit of discussion. > There is an AllowIPs config directive, but not an ExcludeIPs directive. I think you're mostly just tripped up by the naming here. Everything is excluded by default. Add things to AllowedIPs to have packets sent to those IP get encry…

Like I said, spoiled by github. I need to get back into IRC. Never felt comfortable on mailing lists.

I want everything included except my local LAN. I can probably do something stupid to generate a config that works (i.e., such that I manually include 0.0.0.0/8, 1.0.0.0/8, ... etc excluding 192.168.0.0/16) or do something smart outside of wg/wg-quick, but I lack the expertise.

Re: WireGuard is submitted for Linux kernel inclusion

#165

Post by swsieber »

y4mi wrote: post #140
swsieber wrote: post #69

So, since lots of people here have experience with VPN, I'd like to ask theoretical project question: I have distant family memebers, and it'd be nice to have a simple way to get devices on the same network easily. My initial thought would be to setup a VPN server somewhere central and fast, and then distribute wireless routers with custom firmware that they could plugin to their network. Then anything they connect t…

Its doable and is called a site-to-site VPN. There a various options to implement VPNs and each has its own problem -- a) The option everyone else here tries to tell you about is a Client-to-Site VPN. Its downsite is that you'll need to connect each client separately and the VPN isn't entirely 'transparent' (the client and programs can and do know that they're not directly connected to the internet) your performance…

Thank you for the very thorough reply, especially the terminology. Yes, I think what I want is site-to-site vpn hardware to have lan parties with my family on consoles that don't do well with the internet (I'm looking at you nintendo switch).

So multiple people have listed ZeroTier, and you mentioned it as a client-client. It looks like they have a crowdfunding campaign to launch a site-site vpn device... I think: https://www.indiegogo.com/projects/zerotier-edge-open-source...

Edit: Thank you so much for teaching me to fish (the terminology) instead of just giving me a fish (recommendation).

Re: WireGuard is submitted for Linux kernel inclusion

#166

Post by swsieber »

swsieber wrote: post #69

So, since lots of people here have experience with VPN, I'd like to ask theoretical project question: I have distant family memebers, and it'd be nice to have a simple way to get devices on the same network easily. My initial thought would be to setup a VPN server somewhere central and fast, and then distribute wireless routers with custom firmware that they could plugin to their network. Then anything they connect t…

I should have mentioned I'm trying to connect devices that can connect only to wireless that you can't set up a VPN on (the Nintendo Switch). Though I'm sure once I got it setup I'd abuse it for easy file transfer occasionally...

Re: WireGuard is submitted for Linux kernel inclusion

#167

Post by craftyguy »

zx2c4 wrote: post #161
craftyguy wrote: post #158

Earlier quoted context omitted.

>Note that if you run a phone that has the WireGuard kernel module I wonder if LineageOS plans to include this module..

I've been working on it with them actually. We'll see where that goes.

Wow one of my favorite FLOSS developers replied to me! Hopefully they (lineageos) adopt it, it would be a HUGE improvement over the native android VPN options and openvpn.

Re: WireGuard is submitted for Linux kernel inclusion

#168

Post by tialaramex »

zx2c4 wrote: post #159
chasil wrote: post #145

Earlier quoted context omitted.

The docs do say: "Finally, WireGuard is cryptographically opinionated. It intentionally lacks cipher and protocol agility. If holes are found in the underlying primitives, all endpoints will be required to update." ECDH 25519 will fall like a house of cards to a capable quantum computer. Since Wireguard is already entirely DJB, the introduction of a tiny bit of agility with one of Bernstein's submissions (Classic McE…

You can use WireGuard with rather expensive but conservative PQ primitives like Classic McEliece using the PSK feature of WireGuard, giving you hybrid PQ secrecy. The PSK feature was explicitly designed for this. The idea is that first you create a normal WireGuard tunnel. Then _through it_, so that it's authenticated, maybe even over boring old TCP, you negotiate your potpourri of experimental post quantum exchanges…

Does this hold up though?

The PQ algorithms are only adding anything in scenarios where real adversaries can run quantum algorithms to break public key crypto. In those scenarios you don't have worthwhile authentication in WireGuard itself because your adversary broke that with their quantum computer.

The claim of "forward secrecy" seems particularly dubious when resorting to PSKs. Forward secrecy relies upon keys being ephemeral. The PSKs a TLS 1.3 web server remembers for minutes or hours automatically to support fast session resumption maybe count; some semi-detached manual PQ key agreement procedure sounds like it'll get done once and then left in place, no forward secrecy there.

Re: WireGuard is submitted for Linux kernel inclusion

#169

Post by y4mi »

swsieber wrote: post #165
y4mi wrote: post #140

Earlier quoted context omitted.

Its doable and is called a site-to-site VPN. There a various options to implement VPNs and each has its own problem -- a) The option everyone else here tries to tell you about is a Client-to-Site VPN. Its downsite is that you'll need to connect each client separately and the VPN isn't entirely 'transparent' (the client and programs can and do know that they're not directly connected to the internet) your performance…

Thank you for the very thorough reply, especially the terminology. Yes, I think what I want is site-to-site vpn hardware to have lan parties with my family on consoles that don't do well with the internet (I'm looking at you nintendo switch). So multiple people have listed ZeroTier, and you mentioned it as a client-client. It looks like they have a crowdfunding campaign to launch a site-site vpn device... I think: ht…

> It looks like they have a crowdfunding campaign to launch a site-site vpn device

that is what i meant with the appliance.

I can't speak from experience, but what i've read yesterday makes the previously linked comment the most interesting [0]

the edge router costs ~$100 and has enterprise hardware. The only missing feature is the management frontend, which isn't stricly necessary. And the referenced vyatta-wireguard [1] has a code excerpt which looks like a site-to-site vpn

  [0] https://news.ycombinator.com/item?id=17660518
  [1] https://github.com/Lochnair/vyatta-wireguard

Re: WireGuard is submitted for Linux kernel inclusion

#170

Post by zaarn »

therealx wrote: post #109
zaarn wrote: post #51

I can't wait until pfSense supports it. That'll be the moment I'll set the OpenVPN config on fire, because honestly, OpenVPN configs are magic and if it's not generated by some UI wizard, it's probably broken in some scenario. And even if you do the wizard, it's probably broken. Atm I have that funny bug where my laptop drops connection after 3 seconds but my desktop does fine. With the same configuration! Thank OVPN…

OpenVPN is really not that hard to configure, and I'm pretty darn sure my config isnt broken (it's been audited at least twice.)

OpenVPN is quite difficult to configure IMO, 90% of the time I spend setting up an openvpn install is spend figuring out the routes that make everything go and have both server and client set them up properly.
Post reply on HN