Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

lists.zx2c4.com

Post reply on HN
Print view View original

31–40 of 187 posts

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#31

Post by corty »

wmf wrote: post #29
corty wrote: post #23

Earlier quoted context omitted.

Yes, you are exactly right. Wireguard is a typical example of a thing I'd call myopic-cryptographer-protocol. Solve one problem in the minimal fashion that can be called proof-of-concept, do it in a maybe-more-secure way and call it done. Everything else, like proper key distribution and user management, which you need for a real-world deployment that isn't just a personal toy, is left as an exercise to the reader. A…

If people want Wireguard to be a complete multiplatform audited free enterprise VPN solution they need to donate more. A lot more.

Nobody really needs enterprise VPN crap, that stuff does far too much weird stuff that is totally unrelated to what a VPN should do, like patch management, malware scanning, firewalling, and other useless box-ticking.

What we do need is a proper replacement for roughly the things OpenVPN plus PAM can do. A VPN plus some user and key management.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#32

Post by l3s2d »

yobert wrote: post #5
nixcraft wrote: post #2

I would like to see 2FA (app or security key) support built into WireGuard. Otherwise, it is perfect as compared to the OpenVPN mess.

Think of wireguard as the plumbing. There will be a plethora of things available on top of wireguard that will enable all sorts of easy authentication options. (For example, TailScale.)

Related: Does anyone know of a PKI-on-WireGuard implementation? Specifically I'm looking for a system that lets clients join the WireGuard network by presenting a CA-signed certificate.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#33

Post by Scaevolus »

kzrdude wrote: post #18

What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)

Wireguard is a UDP-based VPN protocol that focuses on simplicity and security. Its Linux implementation is a mere 4000 LOC and the protocol has been formally verified. OpenVPN is over 100,000 lines of code PLUS OpenSSL.

https://www.wireguard.com/talks/lpc2018-wireguard-slides.pdf

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#34

Post by basch »

nicoburns wrote: post #19
kzrdude wrote: post #18

What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)

It's a VPN protocol whose USP is being dramatically simpler than OpenVPN, which should mean that it is both easier to use and more secure (and consensus seems to be that it generally delivers on both of those fronts).

dramatically simpler than IPsec.

IPSec is Internet Layer, while TLS/SSL (OpenSSL) are Application Layer

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#35

Post by Sesse__ »

dsr_ wrote: post #20
kzrdude wrote: post #18

What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)

wireguard is a VPN technology that is now integrated into the Linux kernel, and is available on all major platforms. It distinguishes itself from other VPNs by not having knobs to twiddle. Should a security issue arise, it will be necessary to replace it with a wireguard2 or such. This also means that it's very hard to get it wrong in config; either it works or it doesn't, and if it doesn't, you haven't got it workin…

Wireguard is pretty much half of what you'd expect from a VPN. It does the low-level part (encryption, packetization, session setup, NAT traversal, etc. -- the “actual VPN”) brilliantly, but everything around key distribution is left to external systems. (Tailscale is a popular choice, but by no means the only one.) E.g., you can't connect to vpn.example.com with user foo and password bar and that's it; there needs to be an Ed25519 public/private keypair set up on both sides, an IP address range (essentially a routing table), and so on.

Of course, if you want to connect two static networks, wg-quick is all you need. But for the typical “remote worker VPN”, it's pretty much a (great) building block.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#36

Post by freedomben »

Denvercoder9 wrote: post #30
nicoburns wrote: post #19

Earlier quoted context omitted.

It's a VPN protocol whose USP is being dramatically simpler than OpenVPN, which should mean that it is both easier to use and more secure (and consensus seems to be that it generally delivers on both of those fronts).

> It's a VPN protocol whose USP is being dramatically simpler than OpenSSL What? WireGuard is a VPN protocol (and implementation), while OpenSSL is an implementation of TLS. They're not competing with each other, and you can't compare them.

GP probably meant OpenVPN

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#37

Post by cosmosgenius »

Denvercoder9 wrote: post #30
nicoburns wrote: post #19

Earlier quoted context omitted.

It's a VPN protocol whose USP is being dramatically simpler than OpenVPN, which should mean that it is both easier to use and more secure (and consensus seems to be that it generally delivers on both of those fronts).

> It's a VPN protocol whose USP is being dramatically simpler than OpenSSL What? WireGuard is a VPN protocol (and implementation), while OpenSSL is an implementation of TLS. They're not competing with each other, and you can't compare them.

i think it was meant to be openvpn instead on openssl

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#38

Post by nicoburns »

Denvercoder9 wrote: post #30
nicoburns wrote: post #19

Earlier quoted context omitted.

It's a VPN protocol whose USP is being dramatically simpler than OpenVPN, which should mean that it is both easier to use and more secure (and consensus seems to be that it generally delivers on both of those fronts).

> It's a VPN protocol whose USP is being dramatically simpler than OpenSSL What? WireGuard is a VPN protocol (and implementation), while OpenSSL is an implementation of TLS. They're not competing with each other, and you can't compare them.

Yep, got the wrong Open* software. Not sure how I managed that.

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#39

Post by [deleted] »

Denvercoder9 wrote: post #30
nicoburns wrote: post #19

Earlier quoted context omitted.

It's a VPN protocol whose USP is being dramatically simpler than OpenVPN, which should mean that it is both easier to use and more secure (and consensus seems to be that it generally delivers on both of those fronts).

> It's a VPN protocol whose USP is being dramatically simpler than OpenSSL What? WireGuard is a VPN protocol (and implementation), while OpenSSL is an implementation of TLS. They're not competing with each other, and you can't compare them.

[deleted]

Re: WireGuardNT, a high-performance WireGuard implementation for the Windows kernel

#40

Post by hlandau »

corty wrote: post #24
the8472 wrote: post #16

Earlier quoted context omitted.

Wireguard uses perfect forward secrecy, so wouldn't signing the ephemeral session once with the hardware key do the job? Or do they need some more advanced operations that the devices don't expose?

No, you just need a signature. But an Ed25519 signature, which current commercially available smartcards just cannot do. You could be hacking something together with a Nitrokey or maybe Yubikey, those can do Ed25519 signatures. But generally, you would need to fiddle a lot with the implementation, because currently signatures are done in the kernel module, and you'd need to get that into the USB-device for signing an…

Of course, there are smartcards that could do this, you're just not allowed to have them. Plenty of smartcards nowadays are just flash and an ARM core which theoretically could be programmed arbitrarily. These tend to be used for credit cards, etc. Of course they might have acceleration units for specific algorithms like NIST ECDSA but I'd be surprised if Ed25519 couldn't be accommodated.

Unfortunately they're all NDAware, so they may as well not exist. ...But of course I've written about my extensive issues with the smartcard industry before.

Post reply on HN