5 ms·

Just throwing it out there, but WireGuard does more than just make strong crypto "default". Instead of separating, say, transport from encryption (transformati

Just throwing it out there, but WireGuard does more than just make strong crypto "default". Instead of separating, say, transport from encryption (transformation) they tightly couple them. It's intentionally limiting this flexibility for the sake of performance and administration simplicity...in their own words: > It intentionally lacks cipher and protocol agility. If holes are found in the underlying primitives, all endpoints will be required to update. (https://www.wireguard.com/papers/wireguard.pdf https://www.wireguard.com/papers/wireguard.pdf) Just skimming their whitepaper it seems this is done to cram everything into Layer 3 which has administrative and performance benefits. But comes with a significant tradeoff to flexibility. They follow up that statement with something that slightly confuses me: > As shown by the continuing torrent of SSL/TLS vulnerabilities, cipher agility increases complexity monumentally. But the general sense I am getting is WireGuard is strongly opinionated and limited...and one way of spinning that is less vulnerable to user error. Personally, I have trouble equating that to meaning WireGuard is more secure. For similar reasons I have trouble equating OpenVPN configuration to "requiring hardening". That said WireGuard's approach and lower layer, like IPsec, has some serious performance advantages over OpenVPN. Their whitepaper also seems to indicate that it performs better the IPsec, but I would have to see more benchmarks from other sources before making a definitive conclusion on that. Judging from this article and the comments in this overall thread though, it appears that WireGuard has some zealous (perhaps a bit over-zealous) evangelists though.

tptacek 8y ago
There's a growing consensus among cryptography engineers (by no means all of them, but a pretty significant set of them) that cryptographic agility in protocols is a design mistake. That doesn't mean that we should assume modern primitives and constructions are unbreakable (though the trend has been for protocol designers to seriously overestimate the likelihood of _any_ primitive being broken). What it means is that instead of designing and implementing elaborate handshake mechanisms, which inevitably succumb to downgrade attack bugs or, often, worse things, we should version entire protocols. So obviously, if the ChaPoly stack is broken at some point, people will need to update WireGuard (just like they update OpenVPN when TLS bugs are discovered). But they protocol doesn't need to account for anything more than the fact that it might someday be replaced with a different protocol using different primitives. The "agility" protocol designers are looking for has probably, historically, been implemented at the wrong layer. As usual, the closer something is to policy or prognostication, the further up the stack it should go. TLS bakes this stuff into the transport layer, which has hamstrung us and, ironically, not actually done much to protect us against vulnerabilities. WireGuard makes a different, better decision. There's no tradeoff here; this decision is by itself a reason to adopt WireGuard.
- JoachimS 8y ago
  "There's a growing consensus among cryptography engineers (by no means all of them, but a pretty significant set of them) that cryptographic agility in protocols is a design mistake." And yet in 2018 we have proposals like this: https://tools.ietf.org/html/draft-ietf-ntp-using-nts-for-ntp-11 https://tools.ietf.org/html/draft-ietf-ntp-using-nts-for-ntp... To me it looks enormously over engineered with options, versions and flexibility everywhere.
  - tptacek 8y ago
    There's an even growinger consensus among cryptographers that IETF cryptography standardization is a disaster, even with smart people chairing the WGs. It's just a bad process.
woah 8y ago
I'm on a team using Wireguard as a primitive in a complex system: http://altheamesh.com http://altheamesh.com We use Wireguard as an all-purpose tunnel to encrypt bulk traffic in two places in the system. OpenVPN's performance is unacceptable, and IPSec is impossible to work with. Wireguard is very fast, elegant, easy to understand, and well encapsulated. The zealotry is warranted and it's uses go far beyond your basic desktop VPN use case.
- Fnoord 8y ago
  How do Wireguard and ZeroTier compare?
- daxorid 8y ago
  Your project looks interesting, but what are your plans to solve the "exit node problem", e.g. one end user downloads child pornography and two weeks later the Uplink node is swatted by the FBI?
  - woah 8y ago
    We are running exit nodes which are no more risky than running a regular ISP. Other companies are welcome to run exit nodes as well once there is more demand. EDIT: just to clarify, the exit nodes are in data centers near to networks, they are distinct from "gateways" which are the nodes selling internet bandwidth into the mesh network.
    - daxorid 8y ago
      Ok, so the uplink gateways don't actually sink/source packets to the cleartext Internet, they have one more (encrypted) hop to your datacenters first?
nickpsecurity 8y ago
My list shouldnt be seen as exhaustive. You're right that the project has even more traits with benefits. "But the general sense I am getting is WireGuard is strongly opinionated and limited...and one way of spinning that is less vulnerable to user error. Personally, I have trouble equating that to meaning WireGuard is more secure." The principles behind which systems are going to be more secure have been consistent from people like Paul Karger doing 1970's designs/pentests to folks like Bernstein later on. The number of vulnerabilities go up with complexity: handling state, potential interactions that are visible, covert/side channels that might not be, and too many options for users increasing odds of bad configs. We've seen these all happen to complex VPN's, too. So, this isn't mere zealous recommendations: many of us have watched decades worth of software broken ignoring proven principles, WireGuard is one of few of any software following them, empirical evidence says it will be more secure in most (if not all) cases, and so we're promoting it. A better metaphor would be security engineers and researchers promoting a security product since it has strong evidence of actually being secure. Which is exactly what you're seeing for at least four of us here. ;)

tptacek 8y ago

There's a growing consensus among cryptography engineers (by no means all of them, but a pretty significant set of them) that cryptographic agility in protocols is a design mistake. That doesn't mean that we should assume modern primitives and constructions are unbreakable (though the trend has been for protocol designers to seriously overestimate the likelihood of _any_ primitive being broken). What it means is that instead of designing and implementing elaborate handshake mechanisms, which inevitably succumb to downgrade attack bugs or, often, worse things, we should version entire protocols. So obviously, if the ChaPoly stack is broken at some point, people will need to update WireGuard (just like they update OpenVPN when TLS bugs are discovered). But they protocol doesn't need to account for anything more than the fact that it might someday be replaced with a different protocol using different primitives. The "agility" protocol designers are looking for has probably, historically, been implemented at the wrong layer. As usual, the closer something is to policy or prognostication, the further up the stack it should go. TLS bakes this stuff into the transport layer, which has hamstrung us and, ironically, not actually done much to protect us against vulnerabilities. WireGuard makes a different, better decision. There's no tradeoff here; this decision is by itself a reason to adopt WireGuard.

JoachimS 8y ago
"There's a growing consensus among cryptography engineers (by no means all of them, but a pretty significant set of them) that cryptographic agility in protocols is a design mistake." And yet in 2018 we have proposals like this: https://tools.ietf.org/html/draft-ietf-ntp-using-nts-for-ntp-11 https://tools.ietf.org/html/draft-ietf-ntp-using-nts-for-ntp... To me it looks enormously over engineered with options, versions and flexibility everywhere.
- tptacek 8y ago
  There's an even growinger consensus among cryptographers that IETF cryptography standardization is a disaster, even with smart people chairing the WGs. It's just a bad process.

woah 8y ago

I'm on a team using Wireguard as a primitive in a complex system: http://altheamesh.com http://altheamesh.com We use Wireguard as an all-purpose tunnel to encrypt bulk traffic in two places in the system. OpenVPN's performance is unacceptable, and IPSec is impossible to work with. Wireguard is very fast, elegant, easy to understand, and well encapsulated. The zealotry is warranted and it's uses go far beyond your basic desktop VPN use case.

Fnoord 8y ago
How do Wireguard and ZeroTier compare?
daxorid 8y ago
Your project looks interesting, but what are your plans to solve the "exit node problem", e.g. one end user downloads child pornography and two weeks later the Uplink node is swatted by the FBI?
- woah 8y ago
  We are running exit nodes which are no more risky than running a regular ISP. Other companies are welcome to run exit nodes as well once there is more demand. EDIT: just to clarify, the exit nodes are in data centers near to networks, they are distinct from "gateways" which are the nodes selling internet bandwidth into the mesh network.
  - daxorid 8y ago
    Ok, so the uplink gateways don't actually sink/source packets to the cleartext Internet, they have one more (encrypted) hop to your datacenters first?

nickpsecurity 8y ago

My list shouldnt be seen as exhaustive. You're right that the project has even more traits with benefits. "But the general sense I am getting is WireGuard is strongly opinionated and limited...and one way of spinning that is less vulnerable to user error. Personally, I have trouble equating that to meaning WireGuard is more secure." The principles behind which systems are going to be more secure have been consistent from people like Paul Karger doing 1970's designs/pentests to folks like Bernstein later on. The number of vulnerabilities go up with complexity: handling state, potential interactions that are visible, covert/side channels that might not be, and too many options for users increasing odds of bad configs. We've seen these all happen to complex VPN's, too. So, this isn't mere zealous recommendations: many of us have watched decades worth of software broken ignoring proven principles, WireGuard is one of few of any software following them, empirical evidence says it will be more secure in most (if not all) cases, and so we're promoting it. A better metaphor would be security engineers and researchers promoting a security product since it has strong evidence of actually being secure. Which is exactly what you're seeing for at least four of us here. ;)