31–40 of 72 posts
http://blogs.gnome.org/thaller/2019/03/15/wireguard-in-netwo...
Earlier quoted context omitted.
Moving something from userland to the kernel is not generally understood to be attack-surface-minimizing. One of the goals of attack-surface-minimizing designs, like privilege separation, are to get as much out of the kernel (or out of privileged processes) as possible. Hosting WireGuard in-kernel is a performance and compatibility strategy. Being hosted in kernel makes WireGuard higher-risk, which Jason mitigates wi…
Not generally understood but .. my analogy is the castle and the keep. The keep has a smaller attack surface than the castle. Of course if the keep is compromised, your security just failed, dramatically.
Earlier quoted context omitted.
Indeed, the author is confusing things here: - It has a vastly smaller attack surface than e.g. OpenVPN, because it is much less complex. - Its performance is improved by being kernel based. - Compatibility is helped by it being in the mainline kernel, i.e. every device shipping a recent enough kernel will be able to have it (no need to deploy/version libraries etc). These don't have anything to do with each other.
re smaller surface area, adding some numbers, "WireGuard weighs in at around 4,000 lines of code; this compares to 600,000 total lines of code for OpenVPN + OpenSSL or 400,000 total lines of code for XFRM+StrongSwan for an IPSEC VPN. Two orders of magnitude fewer lines of code mean a lot less attack surface to find flaws in." https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review... note openvpn sans openssl is…
It's still smaller, but no need to do useless comparisons.
Earlier quoted context omitted.
re smaller surface area, adding some numbers, "WireGuard weighs in at around 4,000 lines of code; this compares to 600,000 total lines of code for OpenVPN + OpenSSL or 400,000 total lines of code for XFRM+StrongSwan for an IPSEC VPN. Two orders of magnitude fewer lines of code mean a lot less attack surface to find flaws in." https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review... note openvpn sans openssl is…
ZeroTier's core is only about 30k lines of code including quite a lot of verbose multi-line comments, crypto, C++ cruft, and boilerplate. Core functional code implementing ZT is probably roughly 2X the size of Wireguard. How in the hell is IPSec that big? It's bigger if you include all the service and virtual net device and UI stuff, but IPSec doesn't include any of that so comparing to the ZT core is apples to apple…
I'm curious if the stalwarts of the network security space, with their old and crusty VPN concentrators, finally move on WireGuard. Likely not until enough customers move away from them to a solution using, or they get around to finally running a recent kernel.
Earlier quoted context omitted.
ZeroTier's core is only about 30k lines of code including quite a lot of verbose multi-line comments, crypto, C++ cruft, and boilerplate. Core functional code implementing ZT is probably roughly 2X the size of Wireguard. How in the hell is IPSec that big? It's bigger if you include all the service and virtual net device and UI stuff, but IPSec doesn't include any of that so comparing to the ZT core is apples to apple…
I was trying out ZeroTier a few years back and found it fantastic. I was, at the time, working for a large security network device provider and trying to get R&D to bake it into the flagship product - this was before SD-WAN really took off. I never got anywhere with that agenda, but - still think that would have been a fantastic use case. I'm curious if the stalwarts of the network security space, with their old and…
Hm. I guess no-one has bothered with nftables yet, even when dealing with network code that's becoming part of the new upstream kernel (not just this blog, AFAIK wireguard upstream doesn't have any examples on using nftables either, just iptables). I guess we need a new networking how-to? Anyone aware of some resources I might have missed? OK, I guess the nftables wiki is the "how-to": https://wiki.nftables.org/wiki-…
Earlier quoted context omitted.
re smaller surface area, adding some numbers, "WireGuard weighs in at around 4,000 lines of code; this compares to 600,000 total lines of code for OpenVPN + OpenSSL or 400,000 total lines of code for XFRM+StrongSwan for an IPSEC VPN. Two orders of magnitude fewer lines of code mean a lot less attack surface to find flaws in." https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review... note openvpn sans openssl is…
ZeroTier's core is only about 30k lines of code including quite a lot of verbose multi-line comments, crypto, C++ cruft, and boilerplate. Core functional code implementing ZT is probably roughly 2X the size of Wireguard. How in the hell is IPSec that big? It's bigger if you include all the service and virtual net device and UI stuff, but IPSec doesn't include any of that so comparing to the ZT core is apples to apple…
Earlier quoted context omitted.
ZeroTier's core is only about 30k lines of code including quite a lot of verbose multi-line comments, crypto, C++ cruft, and boilerplate. Core functional code implementing ZT is probably roughly 2X the size of Wireguard. How in the hell is IPSec that big? It's bigger if you include all the service and virtual net device and UI stuff, but IPSec doesn't include any of that so comparing to the ZT core is apples to apple…
How is ZeroTier on dynamic allocation? Small code size is one WireGuard software security goal; minimizing dynamic allocation is the other.
We just did phase I of a professional audit for V2. It was a design audit, but we're doing a code audit too. V2's code base will be a bit cleaner.
Earlier quoted context omitted.
I was trying out ZeroTier a few years back and found it fantastic. I was, at the time, working for a large security network device provider and trying to get R&D to bake it into the flagship product - this was before SD-WAN really took off. I never got anywhere with that agenda, but - still think that would have been a fantastic use case. I'm curious if the stalwarts of the network security space, with their old and…
Crusty stalwart here. I'd love to get off crusty VPN concentrators. I'd personally love to see something in the open source space that supports 2FA and a rich, user-based policy language. Tailscale is trying to deliver an enterprise product that builds this on top of Wireguard. I'm not aware of any open source approaches tackling this problem like Tailscale, but I'm keenly interested.