3 ms·

But these are related, aren't they? Not trying to be pedantic or argumentative at all, just better understanding (for myself at least). Being kernel based mea

But these are related, aren't they? Not trying to be pedantic or argumentative at all, just better understanding (for myself at least). Being kernel based means it cannot depend on external/3rd party libraries, which does reduce the attack surface. Of course user-land library can also be written with no other library dependencies, but I think kernel based forces this as a requirement, doesn't it (I don't know for sure, please correct me if I'm wrong)?

tptacek 7y ago
Moving something from userland to the kernel is not generally understood to be attack-surface-minimizing. One of the goals of attack-surface-minimizing designs, like privilege separation, are to get as much out of the kernel (or out of privileged processes) as possible. Hosting WireGuard in-kernel is a performance and compatibility strategy. Being hosted in kernel makes WireGuard higher-risk, which Jason mitigates with other software security tactics, like a simple design that can be implemented without dynamic allocation, and a tiny codebase.
- gricardo99 7y ago
  Thanks for the explanation.
- emmelaich 7y ago
  Not generally understood but .. my analogy is the castle and the keep. The keep has a smaller attack surface than the castle. Of course if the keep is compromised, your security just failed, dramatically.
  - tptacek 7y ago
    Not in this case; what you're talking about here is putting more apertures into the keep.
yjftsjthsd-h 7y ago
Ipsec is in-kernel. I don't know if it's offloading some work into user space, though.
eeZah7Ux 7y ago
> Being kernel based means it cannot depend on external/3rd party libraries, which does reduce the attack surface You are conflating two independent things. An external library could be very secure or not. Same for implementing the same function internally.
- gricardo99 7y ago
  My point that you quote is about dependencies. If A depends on B, they are not independent, by definition.

tptacek 7y ago

Moving something from userland to the kernel is not generally understood to be attack-surface-minimizing. One of the goals of attack-surface-minimizing designs, like privilege separation, are to get as much out of the kernel (or out of privileged processes) as possible. Hosting WireGuard in-kernel is a performance and compatibility strategy. Being hosted in kernel makes WireGuard higher-risk, which Jason mitigates with other software security tactics, like a simple design that can be implemented without dynamic allocation, and a tiny codebase.

gricardo99 7y ago
Thanks for the explanation.
emmelaich 7y ago
Not generally understood but .. my analogy is the castle and the keep. The keep has a smaller attack surface than the castle. Of course if the keep is compromised, your security just failed, dramatically.
- tptacek 7y ago
  Not in this case; what you're talking about here is putting more apertures into the keep.

yjftsjthsd-h 7y ago

Ipsec is in-kernel. I don't know if it's offloading some work into user space, though.

eeZah7Ux 7y ago

> Being kernel based means it cannot depend on external/3rd party libraries, which does reduce the attack surface You are conflating two independent things. An external library could be very secure or not. Same for implementing the same function internally.

gricardo99 7y ago
My point that you quote is about dependencies. If A depends on B, they are not independent, by definition.