Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Yggdrasil – Early-stage implementation of an end-to-end encrypted IPv6 network

github.com

Post reply on HN
Print view View original

101–109 of 109 posts

Re: Yggdrasil – Early-stage implementation of an end-to-end encrypted IPv6 network

#101

Post by edoceo »

mrweasel wrote: post #47
isatty wrote: post #26

Earlier quoted context omitted.

Lifted from the Wikipedia article: Yggdrasil Linux/GNU/X, or LGX (pronounced igg-drah-sill) Don’t need to be a language nerd to understand that.

You have to love that it's a "Linux/GNU/X" system. Not even at GNU/Linux, but a Linux/GNU system... Would Stallman accept that or does GNU have to be first?

Kernel/OS/DE seems a logical order. Or is GNU the Philosophy first? (I thought it means the tools)

Re: Yggdrasil – Early-stage implementation of an end-to-end encrypted IPv6 network

#103

Post by infogulch »

rjmalagon wrote: post #96
infogulch wrote: post #83

How does Yggdrasil compare to Wireguard? A github search shows that yggrasil-go uses wireguard-tun project as the tun driver; does it relate in any other way? The main problem/use case is different of course (Wireguard is a manually configured point-to-point vpn with e2ee, where yggdrasil is an internet-scale overlay network with e2ee.), but I mean at a low level, protocol, encryption, etc.

At low level is not related to WireGuard in any way. The wintun project only exposes a virtual network interface to Windows systems, a clean and proper signed windows driver. That side project to Wireguard was created because the native windows virtual interface is too basic for "advanced vpns" and the former windows TUN driver (OpenVPN side project TUN driver for windows) used by everyone was clunky and old. YG uses…

I see, so there's no real integration between the projects besides the incidental TUN server. It seems like YG would benefit from using WG as a primitive for point-to-point encrypted comms between nodes, and build the spanning tree system on top of it.

Re: Yggdrasil – Early-stage implementation of an end-to-end encrypted IPv6 network

#104

Post by jra_samba »

some_furry wrote: post #95

https://github.com/yggdrasil-network/yggdrasil-go/blob/983df... I've never seen anyone need to check the top byte of a nonce before. This looks very odd to me.

I haven't checked, but this may be due to the restriction in CCM/GCM.

Here is the relevant comment/code from Samba.

   * CCM and GCM algorithms must never have their
   * nonce wrap, or the security of the whole
   * communication and the keys is destroyed.
   * We must drop the connection once we have
   * transfered too much data.
   *
   * NOTE: We assume nonces greater than 8 bytes.
   */
... switch (xconn->smb2.server.cipher) { case SMB2_ENCRYPTION_AES128_CCM: nonce_size = SMB2_AES_128_CCM_NONCE_SIZE; break; case SMB2_ENCRYPTION_AES128_GCM: nonce_size = gnutls_cipher_get_iv_size(GNUTLS_CIPHER_AES_128_GCM); break; default: nonce_size = 0; break; } x->nonce_high_max = SMB2_NONCE_HIGH_MAX(nonce_size); x->nonce_high = 0; x->nonce_low = 0;

Where the definition of SMB2_NONCE_HIGH_MAX is:

#define SMB2_NONCE_HIGH_MAX(nonce_len_bytes) ((uint64_t)(\ ((nonce_len_bytes) >= 16) ? UINT64_MAX : \ ((nonce_len_bytes) <= 8) ? 0 : \ (((uint64_t)1 << (((nonce_len_bytes) - 8)*8)) - 1) \ ))

Re: Yggdrasil – Early-stage implementation of an end-to-end encrypted IPv6 network

#105

Post by poochy »

saalweachter wrote: post #64
RealStickman_ wrote: post #14

Earlier quoted context omitted.

> Yggdrasil Linux/GNU/X, or LGX (pronounced igg-drah-sill) https://en.m.wikipedia.org/wiki/Yggdrasil_Linux/GNU/X

Sounds more like a brand name prescription drug than a Linux distro.

Odin is disappointed in you

Re: Yggdrasil – Early-stage implementation of an end-to-end encrypted IPv6 network

#106

Post by Forbo »

nickik wrote: post #62
apetresc wrote: post #53

Earlier quoted context omitted.

The "P" in VPN usually stands for "Private", not "Public".

I think that was the joke.

You joke, but unfortunately this was the poor wording that GNUnet chose to use. https://docs.gnunet.org/handbook/gnunet.html#First-steps-_00...

I still facepalm whenever I think about this.

Re: Yggdrasil – Early-stage implementation of an end-to-end encrypted IPv6 network

#107

Post by etc-hosts »

reaperducer wrote: post #24
WalterGR wrote: post #8

Earlier quoted context omitted.

Norse mythology has that beat by over 600 years. https://en.wikipedia.org/wiki/Yggdrasil_(disambiguation)

Can anyone help with the pronunciation? There's no help from the Wikipedia article. (Not that Wikipedia pronunciation guides are of any use to anyone other than language nerds, anyway.)

https://youtu.be/jjRjw65fL7s?t=23

Re: Yggdrasil – Early-stage implementation of an end-to-end encrypted IPv6 network

#108

Post by musicale »

I wonder how they deal with the typical problems of tree networks, such as:

- bandwidth bottleneck at the root

- single point of failure at the root

- any node failure partitions its subtrees

- slow, complicated reconfiguration after node or link failure

Re: Yggdrasil – Early-stage implementation of an end-to-end encrypted IPv6 network

#109

Post by natural219 »

rjmalagon wrote: post #97
natural219 wrote: post #85

Earlier quoted context omitted.

I’d also be curious about this. Say for the use case of running a small private chat server hosted on a home network; does either of these seem better suited, or are they just different architectures that can handle mostly similar things?

Very different. WireGuard is explicit basic, only cares how to make an encrypted link between two devices, and do it very well. Key exchange, IP assignation and routing are manual work. There are solution build on top of WireGuard (Tailscale is one of them) that puts some "automagic". YG puts more "magic" on protocol (autorouting, mesh making, etc), but is not that clean on design (crypto not formally tested, latency…

This is really helpful; thank you
Post reply on HN