fancy! i'll ask my friends on windows to test this
WireGuardNT, a high-performance WireGuard implementation for the Windows kernel
11–20 of 187 posts
Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel
#12Earlier quoted context omitted.
WireGuard is not MFA, but the user's private key could probably be stored in a smart-card instead of on disk. Software changes would need to be made so the key is read from the card instead of specified in the wgx.conf file. To achieve true MFA, it would need either a password, TOTP, or SMS in addition to the stored keys.
Nope, can't. Storing a Wireguard key on a Smartcard isn't possible, because current cards do not support the key format and algorithms Wireguard uses. Only RSA and ECDSA on NIST curves are available on Smartcards. And "reading" the key from the card would make the card useless, the important feature of a smartcard is that it doesn't ever make the key available for reading. Instead, the key is used for signing or decr…
Technically if the card could sign fast enough, you could sign packets on the card.
Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel
#13Earlier quoted context omitted.
Nope, can't. Storing a Wireguard key on a Smartcard isn't possible, because current cards do not support the key format and algorithms Wireguard uses. Only RSA and ECDSA on NIST curves are available on Smartcards. And "reading" the key from the card would make the card useless, the important feature of a smartcard is that it doesn't ever make the key available for reading. Instead, the key is used for signing or decr…
Technically if the card could sign fast enough, you could sign packets on the card.
WireGuard seems to use symmetric key crypto for packet encdec. The card would need to sign only the handshake, which occurs "every few minutes"[1] and "is done based on time, and not based on the contents of prior packets"[1].
Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel
#14I would like to see 2FA (app or security key) support built into WireGuard. Otherwise, it is perfect as compared to the OpenVPN mess.
Tailscale solves all these problems, including SSO.
Can you tell I’m a very happy customer?
Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel
#15I would like to see 2FA (app or security key) support built into WireGuard. Otherwise, it is perfect as compared to the OpenVPN mess.
Think of wireguard as the plumbing. There will be a plethora of things available on top of wireguard that will enable all sorts of easy authentication options. (For example, TailScale.)
How this plumbing is expected to be implemented? For example Cloudflare Warp uses Wireguard for its VPN solution, but all key exchanges and other stuff happens via HTTPS REST calls. Is it expected for any non-trivial implementation to build a different "control" protocol? For me it sounds like a dangerous approach. While wireguard protocol will be safe and audited, those additional proprietary protocols will hinder cross-platform usage (for example you had to use reverse-engineered Cloudflare Warp implementation for Linux until recently and I guess that BSDs will use it forever) and might expose security vulnerabilities on their own.
Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel
#16Earlier quoted context omitted.
WireGuard is not MFA, but the user's private key could probably be stored in a smart-card instead of on disk. Software changes would need to be made so the key is read from the card instead of specified in the wgx.conf file. To achieve true MFA, it would need either a password, TOTP, or SMS in addition to the stored keys.
Nope, can't. Storing a Wireguard key on a Smartcard isn't possible, because current cards do not support the key format and algorithms Wireguard uses. Only RSA and ECDSA on NIST curves are available on Smartcards. And "reading" the key from the card would make the card useless, the important feature of a smartcard is that it doesn't ever make the key available for reading. Instead, the key is used for signing or decr…
Wireguard uses perfect forward secrecy, so wouldn't signing the ephemeral session once with the hardware key do the job? Or do they need some more advanced operations that the devices don't expose?
Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel
#17While the driver can be licensed under GPLv2 (all kernel drivers needs to be signed by Microsoft*, and VirtIO is a precedent¤ that you can do it), I'm not sure if the header should be licensed under GPLv2, mainly because it would stifle Wireguard adoption. * In ordinary conditions. Test-sign mode does exist. ¤ ... for example, these Red Hat versions: https://www.catalog.update.microsoft.com/Search.aspx?q=Red%2...
You can get them here: https://fedorapeople.org/groups/virt/virtio-win/direct-downl... packaged in a nice iso, ready to use for iso store of your hypervisor.
(It might be also slightly newer; v204 is 100.85.104.20400).
Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel
#18What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)
Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel
#19What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)
It's a VPN protocol whose USP is being dramatically simpler than OpenVPN, which should mean that it is both easier to use and more secure (and consensus seems to be that it generally delivers on both of those fronts).
Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel
#20What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)
wireguard is a VPN technology that is now integrated into the Linux kernel, and is available on all major platforms.
It distinguishes itself from other VPNs by not having knobs to twiddle. Should a security issue arise, it will be necessary to replace it with a wireguard2 or such. This also means that it's very hard to get it wrong in config; either it works or it doesn't, and if it doesn't, you haven't got it working yet.
It's very fast and very nice to work with.