> WireGuard is 4000 LOC, IPSec is 400,000 LOC and OpenVPN is of similar complexity. Bollocks. $ cat netinet/ip_ah.c netinet/ip_ecn.c \ netinet/ip_esp.c ne

> WireGuard is 4000 LOC, IPSec is 400,000 LOC and OpenVPN is of similar complexity. Bollocks. $ cat netinet/ip_ah.c netinet/ip_ecn.c \ netinet/ip_esp.c netinet/ip_ipsp.c netinet/ip_spd.c \ netinet/ipsec_input.c netinet/ipsec_output.c | wc -l 6445 You're comparing apples and oranges. Most critics implicitly count IKE and other PKI-related bits as part of IPSec. But Wireguard doesn't offer anything comparable. So if you want to compare apples & apples, you can only compare the actual transport layer. Wireguard is still more elegant, but of course Wireguard has the benefit of hindsight and IPSec has 20+ years of operational fixes. What's happening is that because Wireguard doesn't include PKI people end up gluing together poor man's PKI with shell scripts and shoe strings. PKI is the hard part of key management, and because Wireguard doesn't attempt to solve it, it doesn't incur any of those costs. And the people who do try to solve it and get it horrible wrong, well I guess that's just not Wireguard's fault, right? How convenient.