4 ms·

re smaller surface area, adding some numbers, "WireGuard weighs in at around 4,000 lines of code; this compares to 600,000 total lines of code for OpenVPN + Ope

re smaller surface area, adding some numbers, "WireGuard weighs in at around 4,000 lines of code; this compares to 600,000 total lines of code for OpenVPN + OpenSSL or 400,000 total lines of code for XFRM+StrongSwan for an IPSEC VPN. Two orders of magnitude fewer lines of code mean a lot less attack surface to find flaws in." https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connections-amaze-but-windows-support-needs-to-happen/ https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review... note openvpn sans openssl is 70k (supports multiple crypto libs), but given Wireguard's code size is including crypto, it seems apt to compare totals. linus on a comparison, "Can I just once again state my love for it and hope it gets merged soon? Maybe the code isn't perfect, but I've skimmed it, and compared to the horrors that are OpenVPN and IPSec, it's a work of art." https://lwn.net/Articles/761939/ https://lwn.net/Articles/761939/

ignoramous 7y ago
> ...compared to the horrors that are OpenVPN and IPSec, it's a work of art. https://wireguard.com/ https://wireguard.com/ should put that quote up as a, well, social proof.
- lifepillar 7y ago
  WireGuard’s protocol was also formally verified by a third party [0]. That makes me more confident in using it than any social proof whatsoever :) [0] https://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/WireGuard/ https://prosecco.gforge.inria.fr/personal/bblanche/cryptover...
api 7y ago
ZeroTier's core is only about 30k lines of code including quite a lot of verbose multi-line comments, crypto, C++ cruft, and boilerplate. Core functional code implementing ZT is probably roughly 2X the size of Wireguard. How in the hell is IPSec that big? It's bigger if you include all the service and virtual net device and UI stuff, but IPSec doesn't include any of that so comparing to the ZT core is apples to apples.
- windexh8er 7y ago
  I was trying out ZeroTier a few years back and found it fantastic. I was, at the time, working for a large security network device provider and trying to get R&D to bake it into the flagship product - this was before SD-WAN really took off. I never got anywhere with that agenda, but - still think that would have been a fantastic use case. I'm curious if the stalwarts of the network security space, with their old and crusty VPN concentrators, finally move on WireGuard. Likely not until enough customers move away from them to a solution using, or they get around to finally running a recent kernel.
  - fairramone 7y ago
    Crusty stalwart here. I'd love to get off crusty VPN concentrators. I'd personally love to see something in the open source space that supports 2FA and a rich, user-based policy language. Tailscale is trying to deliver an enterprise product that builds this on top of Wireguard. I'm not aware of any open source approaches tackling this problem like Tailscale, but I'm keenly interested.
    - api 7y ago
      Curious if you can provide any links to exactly what you need. 2FA is obvious but what kinds of policy languages are you thinking of? There are numerous variations out there.
      - brentis 7y ago
        Look up Appgate sdp
- tptacek 7y ago
  How is ZeroTier on dynamic allocation? Small code size is one WireGuard software security goal; minimizing dynamic allocation is the other.
  - api 7y ago
megous 7y ago
Wireguard is 6k lines if you don't count tools, crypto code, tests, etc. And god knows what is counted in those 600k lines of OpenSSL+OpenVPN, probably all kind of code that's not really used at all by OpenVPN. It's still smaller, but no need to do useless comparisons.

ignoramous 7y ago

> ...compared to the horrors that are OpenVPN and IPSec, it's a work of art. https://wireguard.com/ https://wireguard.com/ should put that quote up as a, well, social proof.

lifepillar 7y ago
WireGuard’s protocol was also formally verified by a third party [0]. That makes me more confident in using it than any social proof whatsoever :) [0] https://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/WireGuard/ https://prosecco.gforge.inria.fr/personal/bblanche/cryptover...

api 7y ago

ZeroTier's core is only about 30k lines of code including quite a lot of verbose multi-line comments, crypto, C++ cruft, and boilerplate. Core functional code implementing ZT is probably roughly 2X the size of Wireguard. How in the hell is IPSec that big? It's bigger if you include all the service and virtual net device and UI stuff, but IPSec doesn't include any of that so comparing to the ZT core is apples to apples.

windexh8er 7y ago
I was trying out ZeroTier a few years back and found it fantastic. I was, at the time, working for a large security network device provider and trying to get R&D to bake it into the flagship product - this was before SD-WAN really took off. I never got anywhere with that agenda, but - still think that would have been a fantastic use case. I'm curious if the stalwarts of the network security space, with their old and crusty VPN concentrators, finally move on WireGuard. Likely not until enough customers move away from them to a solution using, or they get around to finally running a recent kernel.
- fairramone 7y ago
  Crusty stalwart here. I'd love to get off crusty VPN concentrators. I'd personally love to see something in the open source space that supports 2FA and a rich, user-based policy language. Tailscale is trying to deliver an enterprise product that builds this on top of Wireguard. I'm not aware of any open source approaches tackling this problem like Tailscale, but I'm keenly interested.
  - api 7y ago
    Curious if you can provide any links to exactly what you need. 2FA is obvious but what kinds of policy languages are you thinking of? There are numerous variations out there.
    - brentis 7y ago
      Look up Appgate sdp
tptacek 7y ago
How is ZeroTier on dynamic allocation? Small code size is one WireGuard software security goal; minimizing dynamic allocation is the other.
- api 7y ago

megous 7y ago

Wireguard is 6k lines if you don't count tools, crypto code, tests, etc. And god knows what is counted in those 600k lines of OpenSSL+OpenVPN, probably all kind of code that's not really used at all by OpenVPN. It's still smaller, but no need to do useless comparisons.