Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

lists.zx2c4.com

Post reply on HN
Print view View original

1–10 of 187 posts

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#3

Post by jagger27 »

nixcraft wrote: post #2

I would like to see 2FA (app or security key) support built into WireGuard. Otherwise, it is perfect as compared to the OpenVPN mess.

Isn’t that just a roundabout way of asking for PSK support (which it already has)?

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#4

Post by Panino »

Very impressive performance:

> While performance is quite good right now (~7.5Gbps TX on my small test box), not a lot of effort has yet been spent on optimizing it

> Jonathan Tooker reported to me that, on his system with an Intel AC9560 WiFi card, he gets ~600Mbps without WireGuard, ~600Mbps with wireguard-go/Wintun over Ethernet, ~95Mbps with wireguard-go/Wintun over WiFi, and ~600Mbps with WireGuardNT over WiFi.

Congratulations to Simon and Jason! Very happy WireGuard user here.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#5

Post by yobert »

nixcraft wrote: post #2

I would like to see 2FA (app or security key) support built into WireGuard. Otherwise, it is perfect as compared to the OpenVPN mess.

Think of wireguard as the plumbing. There will be a plethora of things available on top of wireguard that will enable all sorts of easy authentication options. (For example, TailScale.)

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#6

Post by zinekeller »

While the driver can be licensed under GPLv2 (all kernel drivers needs to be signed by Microsoft*, and VirtIO is a precedent¤ that you can do it), I'm not sure if the header should be licensed under GPLv2, mainly because it would stifle Wireguard adoption.

* In ordinary conditions. Test-sign mode does exist.

¤ ... for example, these Red Hat versions: https://www.catalog.update.microsoft.com/Search.aspx?q=Red%2...

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#7

Post by anonymousiam »

nixcraft wrote: post #2

I would like to see 2FA (app or security key) support built into WireGuard. Otherwise, it is perfect as compared to the OpenVPN mess.

WireGuard is not MFA, but the user's private key could probably be stored in a smart-card instead of on disk. Software changes would need to be made so the key is read from the card instead of specified in the wgx.conf file.

To achieve true MFA, it would need either a password, TOTP, or SMS in addition to the stored keys.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#8

Post by idorosen »

nixcraft wrote: post #2

I would like to see 2FA (app or security key) support built into WireGuard. Otherwise, it is perfect as compared to the OpenVPN mess.

WireGuard itself doesn't even handle its existing authentication fully -- you are expected to exchange peer public keys out of band. There are several projects that try to tackle this public key exchange. I think what you're asking for, indirectly, is support for certificate authority style authentication similar to how SSH CAs work, so that wireguard could authenticate tunnels using certificates with signed pubkeys instead of statically configured pubkeys themselves for each peer.

If the wireguard core included any kind of timed partial delegation of authority through key signatures (similar to what SSH allows now with cert-authority/CertificateFile), that'd be enough to build SMS/HOTP/TOTP 2FA, security keys, and much more on top of it.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#9

Post by corty »

anonymousiam wrote: post #7
nixcraft wrote: post #2

I would like to see 2FA (app or security key) support built into WireGuard. Otherwise, it is perfect as compared to the OpenVPN mess.

WireGuard is not MFA, but the user's private key could probably be stored in a smart-card instead of on disk. Software changes would need to be made so the key is read from the card instead of specified in the wgx.conf file. To achieve true MFA, it would need either a password, TOTP, or SMS in addition to the stored keys.

Nope, can't. Storing a Wireguard key on a Smartcard isn't possible, because current cards do not support the key format and algorithms Wireguard uses. Only RSA and ECDSA on NIST curves are available on Smartcards. And "reading" the key from the card would make the card useless, the important feature of a smartcard is that it doesn't ever make the key available for reading. Instead, the key is used for signing or decrypting _on the card_ only. If you can really read a key off of a smartcard, sue the manufacturer and never use the key or card again.
Post reply on HN