141–150 of 189 posts
I can foresee a long, long and mostly pointless discussion/argument about code line length.
Nah, if people freak out I'll just change it. I _prefer_ my insanely long lines, and if Dave & co are alright with my preference, great, but if not, Linux is a big project with many people, and I'm happy to accommodate for different preferences.
Earlier quoted context omitted.
> none of that other stuff has anything to do with wireguard Sure, none of it is specific to Wireguard, but my personal use case was "hey, Wireguard looks cool, maybe I could use it to access my home LAN when I'm away. Hmm, how do I talk to the other machines from the VPN server?". It's like saying "if you want to bake a cake, none of the baking has anything to do with our flour". You're technically right, but it'll…
"How do I talk to the other machines from the vpn server" The same way you would if everything on your side of the VPN tunnel was on the other side of the VPN tunnel, there was no VPN, and the VPN server was just a router joining the two subnets.
Earlier quoted context omitted.
What I am wondering is why they chose 25519. It would seem to me that offering NTRU Prime or one of the other NIST finalists would be a prudent future protection. https://csrc.nist.gov/Projects/Post-Quantum-Cryptography/Rou...
Doing DH with Curve25519 is a broadly understood conventional public key based key agreement scheme. We have good reason to think these are an excellent, fast, secure way to do things, unless your adversary has a working large Quantum Computer so that they can use Shor's algorithm. NTRU Prime is for a post-quantum KEM. This does, yes, solve the same piece of the puzzle in a sense. But it's essentially one enormous ex…
ECDH 25519 will fall like a house of cards to a capable quantum computer. Since Wireguard is already entirely DJB, the introduction of a tiny bit of agility with one of Bernstein's submissions (Classic McEliece, NTRU Prime, Post-quantum RSA-Encryption/Signature, and SPHINCS+) seems far from unreasonable.
On the other hand, I'm on Oracle Linux, so I get a new kernel about once a week anyway. Swapping out might not be that traumatic for me, since I can ksplice it into critical systems.
Android, however, cannot do that.
p.s. ...after further reading, Wireguard does have optional, pre-shared symmetric keys. This isn't an ideal solution, but it's something anyway.
"In order to mitigate any future advances in quantum computing, WireGuard also supports a mode in which any pair of peers might additionally pre-share a single 256-bit symmetric encryption key between themselves, in order to add an additional layer of symmetric encryption."
So, since lots of people here have experience with VPN, I'd like to ask theoretical project question: I have distant family memebers, and it'd be nice to have a simple way to get devices on the same network easily. My initial thought would be to setup a VPN server somewhere central and fast, and then distribute wireless routers with custom firmware that they could plugin to their network. Then anything they connect t…
Consider that cutting edge companies are in the process of basically deprecating their LAN in favor of app-based security. Google "zero trust network" or BeyondCorp.
You can build this sort of ecosystem yourself using commercially available products and services. Instead of enterprise single-sign-on, set up family members with a password manager.
I use WireGuard to give my IPv4 only home computers fixed IPv6 addresses and connectivity via my VPS. It also serves as a sort of overlay network, where my devices despite not having a fixed IP address, are still reachable on a WireGuard network via my VPS.
Earlier quoted context omitted.
After that point it works exactly like any other network connection. I'm not sure what you feel needs to be documented here.
Common use cases. People will hear about WireGuard the new OpenVPN, and they'll want to "just set up a quick VPN" with it, to "hide their IP address" or whatever. Of course it's up to WG to decide if they want to deal with this kind of community education/outreach.
So, since lots of people here have experience with VPN, I'd like to ask theoretical project question: I have distant family memebers, and it'd be nice to have a simple way to get devices on the same network easily. My initial thought would be to setup a VPN server somewhere central and fast, and then distribute wireless routers with custom firmware that they could plugin to their network. Then anything they connect t…
ZeroTier. It's excellent for your use case.