61–70 of 187 posts
What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)
Wireguard is a UDP-based VPN protocol that focuses on simplicity and security. Its Linux implementation is a mere 4000 LOC and the protocol has been formally verified. OpenVPN is over 100,000 lines of code PLUS OpenSSL. https://www.wireguard.com/talks/lpc2018-wireguard-slides.pdf
Does anyone have experience with udp2raw or udptunnel?
Earlier quoted context omitted.
Yes, you are exactly right. Wireguard is a typical example of a thing I'd call myopic-cryptographer-protocol. Solve one problem in the minimal fashion that can be called proof-of-concept, do it in a maybe-more-secure way and call it done. Everything else, like proper key distribution and user management, which you need for a real-world deployment that isn't just a personal toy, is left as an exercise to the reader. A…
That's one way to look at it. Another would be "Do one thing and do it well", which is Unix philosophy. https://en.m.wikipedia.org/wiki/Unix_philosophy
What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)
According to Linus: "...compared to the horrors that are OpenVPN and IPSec, it’s a work of art."
What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)
I think you could reasonably look at WireGuard as a repudiation of previous VPN protocols, almost from root to branch. For instance, WireGuard reconsiders what the role of a VPN "protocol" actually is, and in WireGuard the protocol itself delivers a point-to-point secure tunnel and nothing else, so that the system is composable with multiple different upper-level designs (for instance, how you mesh up with multiple e…
Earlier quoted context omitted.
That's one way to look at it. Another would be "Do one thing and do it well", which is Unix philosophy. https://en.m.wikipedia.org/wiki/Unix_philosophy
Another might be that existing VPN solutions will gut the bottom of their stack and use WireGuard for that, thereby reducing complexity and increasing performance.
Earlier quoted context omitted.
Think of wireguard as the plumbing. There will be a plethora of things available on top of wireguard that will enable all sorts of easy authentication options. (For example, TailScale.)
Related: Does anyone know of a PKI-on-WireGuard implementation? Specifically I'm looking for a system that lets clients join the WireGuard network by presenting a CA-signed certificate.
Earlier quoted context omitted.
dramatically simpler than IPsec. IPSec is Internet Layer, while TLS/SSL (OpenSSL) are Application Layer
the main reason IPsec is more complex is because it has more features, like multiple CHILD_SA under same tunnel each with different transform and traffic selectors, and also much more authentication choices
But no, it's the typical groupthink of 'old is bad' so instead of reading two pages of documentation and having native support across all major platforms people would rather re-invent the wheel.
Earlier quoted context omitted.
I think you could reasonably look at WireGuard as a repudiation of previous VPN protocols, almost from root to branch. For instance, WireGuard reconsiders what the role of a VPN "protocol" actually is, and in WireGuard the protocol itself delivers a point-to-point secure tunnel and nothing else, so that the system is composable with multiple different upper-level designs (for instance, how you mesh up with multiple e…
Does it use key management like SSH or more like certificates with TLS?
Earlier quoted context omitted.
wireguard is a VPN technology that is now integrated into the Linux kernel, and is available on all major platforms. It distinguishes itself from other VPNs by not having knobs to twiddle. Should a security issue arise, it will be necessary to replace it with a wireguard2 or such. This also means that it's very hard to get it wrong in config; either it works or it doesn't, and if it doesn't, you haven't got it workin…
Except FreeBSD which is used for pfSense - a popular firewall. They're working on it though. There was a bit of drama about it a few months ago when a shoddy implementation was merged.