9 ms·

> It’s kernel-based which reduces attack surface and can be ran in virtually any device. Excuse my ignorance, but can someone explain why a kernel based networ

> It’s kernel-based which reduces attack surface and can be ran in virtually any device. Excuse my ignorance, but can someone explain why a kernel based networking stack has less of an attack surface then a user-space based stack? I mean logically user-space should be more secure no?

traceroute66 7y ago
I have been a bit weary of the WireGuard hype for much the same reason. Surely kernel mode is (a) the equivalent of running as root (b) opens up greater attack surface by virtue of running at kernel level
- zerkten 7y ago
  I have only experimented a bit with WireGuard because I wanted to avoid OpenVPN. The argument seems to be that it's more secure because it's implementation is small (the implication being that it's easier to audit) and being in the kernel ensures mass adoption (ensuring even more likelihood of audits and quick patches.) I'm interested if there are other technical advantages for specific threat models.
outworlder 7y ago
This goes both ways. Userland systems are susceptible to a myriad of attacks that a kernel, being privileged code, is not. We rely on the kernel (plus CPU rings) for most of the security enforcement in a machine, after all. However, IF that code is compromised, the consequences are much more catastrophic.
- greatjack613 7y ago
  That sounds interesting. Can you elaborate on which attacks userland system are susceptible to that a kernel is not?
  - eximius 7y ago
    A userland process can view/edit the memory of another userland process. Not so with kernel processes.
    - usr1106 7y ago
      Viewing/editing of another userland process is usually done using ptrace(2). Yama Linux security module prevents that unless you are root to disable it. It is active by default on Ubuntu. Also reading /proc/nnnn/mem does not work even for your own processes and even though file node protections seem to allow it, not sure where that security enhancement comes from.
tpolzer 7y ago
Indeed, the author is confusing things here: - It has a vastly smaller attack surface than e.g. OpenVPN, because it is much less complex. - Its performance is improved by being kernel based. - Compatibility is helped by it being in the mainline kernel, i.e. every device shipping a recent enough kernel will be able to have it (no need to deploy/version libraries etc). These don't have anything to do with each other.
- kapilvt 7y ago
  re smaller surface area, adding some numbers, "WireGuard weighs in at around 4,000 lines of code; this compares to 600,000 total lines of code for OpenVPN + OpenSSL or 400,000 total lines of code for XFRM+StrongSwan for an IPSEC VPN. Two orders of magnitude fewer lines of code mean a lot less attack surface to find flaws in." https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connections-amaze-but-windows-support-needs-to-happen/ https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review... note openvpn sans openssl is 70k (supports multiple crypto libs), but given Wireguard's code size is including crypto, it seems apt to compare totals. linus on a comparison, "Can I just once again state my love for it and hope it gets merged soon? Maybe the code isn't perfect, but I've skimmed it, and compared to the horrors that are OpenVPN and IPSec, it's a work of art." https://lwn.net/Articles/761939/ https://lwn.net/Articles/761939/
  - ignoramous 7y ago
    > ...compared to the horrors that are OpenVPN and IPSec, it's a work of art. https://wireguard.com/ https://wireguard.com/ should put that quote up as a, well, social proof.
    - lifepillar 7y ago
      WireGuard’s protocol was also formally verified by a third party [0]. That makes me more confident in using it than any social proof whatsoever :) [0] https://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/WireGuard/ https://prosecco.gforge.inria.fr/personal/bblanche/cryptover...
  - 7y ago
wmf 7y ago
BTW if people want to try userspace WireGuard: https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun

traceroute66 7y ago

I have been a bit weary of the WireGuard hype for much the same reason. Surely kernel mode is (a) the equivalent of running as root (b) opens up greater attack surface by virtue of running at kernel level

zerkten 7y ago
I have only experimented a bit with WireGuard because I wanted to avoid OpenVPN. The argument seems to be that it's more secure because it's implementation is small (the implication being that it's easier to audit) and being in the kernel ensures mass adoption (ensuring even more likelihood of audits and quick patches.) I'm interested if there are other technical advantages for specific threat models.

outworlder 7y ago

This goes both ways. Userland systems are susceptible to a myriad of attacks that a kernel, being privileged code, is not. We rely on the kernel (plus CPU rings) for most of the security enforcement in a machine, after all. However, IF that code is compromised, the consequences are much more catastrophic.

greatjack613 7y ago
That sounds interesting. Can you elaborate on which attacks userland system are susceptible to that a kernel is not?
- eximius 7y ago
  A userland process can view/edit the memory of another userland process. Not so with kernel processes.
  - usr1106 7y ago
    Viewing/editing of another userland process is usually done using ptrace(2). Yama Linux security module prevents that unless you are root to disable it. It is active by default on Ubuntu. Also reading /proc/nnnn/mem does not work even for your own processes and even though file node protections seem to allow it, not sure where that security enhancement comes from.

tpolzer 7y ago

Indeed, the author is confusing things here: - It has a vastly smaller attack surface than e.g. OpenVPN, because it is much less complex. - Its performance is improved by being kernel based. - Compatibility is helped by it being in the mainline kernel, i.e. every device shipping a recent enough kernel will be able to have it (no need to deploy/version libraries etc). These don't have anything to do with each other.

kapilvt 7y ago
re smaller surface area, adding some numbers, "WireGuard weighs in at around 4,000 lines of code; this compares to 600,000 total lines of code for OpenVPN + OpenSSL or 400,000 total lines of code for XFRM+StrongSwan for an IPSEC VPN. Two orders of magnitude fewer lines of code mean a lot less attack surface to find flaws in." https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connections-amaze-but-windows-support-needs-to-happen/ https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review... note openvpn sans openssl is 70k (supports multiple crypto libs), but given Wireguard's code size is including crypto, it seems apt to compare totals. linus on a comparison, "Can I just once again state my love for it and hope it gets merged soon? Maybe the code isn't perfect, but I've skimmed it, and compared to the horrors that are OpenVPN and IPSec, it's a work of art." https://lwn.net/Articles/761939/ https://lwn.net/Articles/761939/
- ignoramous 7y ago
  > ...compared to the horrors that are OpenVPN and IPSec, it's a work of art. https://wireguard.com/ https://wireguard.com/ should put that quote up as a, well, social proof.
  - lifepillar 7y ago
    WireGuard’s protocol was also formally verified by a third party [0]. That makes me more confident in using it than any social proof whatsoever :) [0] https://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/WireGuard/ https://prosecco.gforge.inria.fr/personal/bblanche/cryptover...
- 7y ago

wmf 7y ago

BTW if people want to try userspace WireGuard: https://github.com/cloudflare/boringtun https://github.com/cloudflare/boringtun