Getting Started with WireGuard

Post by boromi » Tue, Apr 07, 2020, 7:44 PM UTC

Post by squarefoot » Tue, Apr 07, 2020, 7:56 PM UTC

nightfly wrote: post #21

squarefoot wrote: post #19

Does wireguard have a noticeable overhead wrt data size compared to a unencrypted connection? I was thinking of setting up it on a small RPi-Like board at home, then on the laptop I carry around (when the lockdown is over). The purpose would be connecting to the Internet through the home broadband public IP which could be handy. However the laptop connects through a metered 4G connection which, although the data cap…

I just sent 200MiB of zeros over my wireguard connection to my VPS and my transmit counter on my wifi card went up by 238MB. Vs sending 1024MiB over just wifi to my Pi where the transmit counter went up by 1.04GiB.

Post by wmf » Tue, Apr 07, 2020, 7:59 PM UTC

greatjack613 wrote: post #2

> It’s kernel-based which reduces attack surface and can be ran in virtually any device. Excuse my ignorance, but can someone explain why a kernel based networking stack has less of an attack surface then a user-space based stack? I mean logically user-space should be more secure no?

Post by ignoramous » Tue, Apr 07, 2020, 8:43 PM UTC

kapilvt wrote: post #16

tpolzer wrote: post #14

Earlier quoted context omitted.

Indeed, the author is confusing things here: - It has a vastly smaller attack surface than e.g. OpenVPN, because it is much less complex. - Its performance is improved by being kernel based. - Compatibility is helped by it being in the mainline kernel, i.e. every device shipping a recent enough kernel will be able to have it (no need to deploy/version libraries etc). These don't have anything to do with each other.

re smaller surface area, adding some numbers, "WireGuard weighs in at around 4,000 lines of code; this compares to 600,000 total lines of code for OpenVPN + OpenSSL or 400,000 total lines of code for XFRM+StrongSwan for an IPSEC VPN. Two orders of magnitude fewer lines of code mean a lot less attack surface to find flaws in." https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review... note openvpn sans openssl is…

Post by emmelaich » Tue, Apr 07, 2020, 9:05 PM UTC

tptacek wrote: post #18

gricardo99 wrote: post #17

Earlier quoted context omitted.

But these are related, aren't they? Not trying to be pedantic or argumentative at all, just better understanding (for myself at least). Being kernel based means it cannot depend on external/3rd party libraries, which does reduce the attack surface. Of course user-land library can also be written with no other library dependencies, but I think kernel based forces this as a requirement, doesn't it (I don't know for sur…

Moving something from userland to the kernel is not generally understood to be attack-surface-minimizing. One of the goals of attack-surface-minimizing designs, like privilege separation, are to get as much out of the kernel (or out of privileged processes) as possible. Hosting WireGuard in-kernel is a performance and compatibility strategy. Being hosted in kernel makes WireGuard higher-risk, which Jason mitigates wi…