10 ms·

What is WireGuard, is it a new protocol? Or a new algorithm for implementing an existing thing? (Or something else)

nicoburns 5y ago
It's a VPN protocol whose USP is being dramatically simpler than OpenVPN, which should mean that it is both easier to use and more secure (and consensus seems to be that it generally delivers on both of those fronts).
- Denvercoder9 5y ago
  > It's a VPN protocol whose USP is being dramatically simpler than OpenSSL What? WireGuard is a VPN protocol (and implementation), while OpenSSL is an implementation of TLS. They're not competing with each other, and you can't compare them.
  - freedomben 5y ago
    GP probably meant OpenVPN
  - cosmosgenius 5y ago
    i think it was meant to be openvpn instead on openssl
  - nicoburns 5y ago
    Yep, got the wrong Open* software. Not sure how I managed that.
  - deleted 5y ago
    [deleted]
- basch 5y ago
  dramatically simpler than IPsec. IPSec is Internet Layer, while TLS/SSL (OpenSSL) are Application Layer
  - netr0ute 5y ago
    >IPSec is Internet Layer Technically not, since IPSec can also be tunneled over UDP which then turns it into an application layer protocol.
    - perryizgr8 5y ago
      I don't think it works like that. Vxlan can tunnel ethernet frames over UDP, but that doesn't make Ethernet an application layer protocol.
      - shawnz 5y ago
        These semantic issues are why "layers" are a terrible way of classifying network protocols
  - hujun 5y ago
    the main reason IPsec is more complex is because it has more features, like multiple CHILD_SA under same tunnel each with different transform and traffic selectors, and also much more authentication choices
    - puzzlingcaptcha 5y ago
      I honestly think "ipsec is too complex" is overdone. Yes, you need to know your networking basics and understand routing but that's probably a good thing when setting up a VPN. Then you pick your crypto primitives from e.g. https://www.keylength.com/en/compare/ https://www.keylength.com/en/compare/ and you are basically done. But no, it's the typical groupthink of 'old is bad' so instead of reading two pages of documentation and having native support across all major platforms people would rather re-invent the wheel.
dsr_ 5y ago
wireguard is a VPN technology that is now integrated into the Linux kernel, and is available on all major platforms. It distinguishes itself from other VPNs by not having knobs to twiddle. Should a security issue arise, it will be necessary to replace it with a wireguard2 or such. This also means that it's very hard to get it wrong in config; either it works or it doesn't, and if it doesn't, you haven't got it working yet. It's very fast and very nice to work with.
- deleted 5y ago
  [deleted]
- Trufa 5y ago
  That sounds heavenly. I had never really thought about that immutability like concept, makes a lot of sense for security oriented software.
- Sesse__ 5y ago
  Wireguard is pretty much half of what you'd expect from a VPN. It does the low-level part (encryption, packetization, session setup, NAT traversal, etc. -- the “actual VPN”) brilliantly, but everything around key distribution is left to external systems. (Tailscale is a popular choice, but by no means the only one.) E.g., you can't connect to vpn.example.com with user foo and password bar and that's it; there needs to be an Ed25519 public/private keypair set up on both sides, an IP address range (essentially a routing table), and so on. Of course, if you want to connect two static networks, wg-quick is all you need. But for the typical “remote worker VPN”, it's pretty much a (great) building block.
  - netr0ute 5y ago
    > but everything around key distribution is left to external systems. That's what I'd like, since authentication is usually a pain to set up and with Wireguard, there's none to be done. This also means it's totally stateless and is great for mobile devices where a connection might be broken and crsated again frequently.
  - nemosaltat 5y ago
Scaevolus 5y ago
Wireguard is a UDP-based VPN protocol that focuses on simplicity and security. Its Linux implementation is a mere 4000 LOC and the protocol has been formally verified. OpenVPN is over 100,000 lines of code PLUS OpenSSL. https://www.wireguard.com/talks/lpc2018-wireguard-slides.pdf https://www.wireguard.com/talks/lpc2018-wireguard-slides.pdf
- TedDoesntTalk 5y ago
  It's point-to-point.
stjohnswarts 5y ago
The wikipedia article for it is actually quite informative and not hard to read for the layperson. https://lmwtfy.joe.gl/?q=wireguard https://lmwtfy.joe.gl/?q=wireguard Also Ars had a great article on it as well if you want a readable but more in depth version https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connections-amaze-but-windows-support-needs-to-happen/ https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review...
tptacek 5y ago
I think you could reasonably look at WireGuard as a repudiation of previous VPN protocols, almost from root to branch. For instance, WireGuard reconsiders what the role of a VPN "protocol" actually is, and in WireGuard the protocol itself delivers a point-to-point secure tunnel and nothing else, so that the system is composable with multiple different upper-level designs (for instance, how you mesh up with multiple endpoints, or how you authenticate). Another reasonable way to look at WireGuard is that it's the Signal Protocol-era VPN protocol (WireGuard is derived from Trevor Perrin's Noise protocol framework). Notably: WireGuard doesn't attempt to negotiate cryptographic parameters. Instead, they've selected a good set of base primitives (Curve25519, Blake2, ChaPoly) and that's that; if those primitives ever change, they'll version the whole protocol. If you haven't played with it, WireGuard is approximately as hard to set up as an SSH connection. It is really a breath of fresh air.
- pkaye 5y ago
  Does it use key management like SSH or more like certificates with TLS?
  - simcop2387 5y ago
    It's more like client certs with tls that are signed by the server's key I believe.
    - lights0123 5y ago
      Nope. You have a private and public key per connection.
      - psanford 5y ago
        Generally, you have a keypair per host, not per connection.
  - Macha 5y ago
    It's like SSH, with no Trust-on-First-Use option. Unlike more complicated pre-existing protocols, how you handle key distribution is explicitly out of scope for the protocol.
phkahler 5y ago
>> What is WireGuard? According to Linus: "...compared to the horrors that are OpenVPN and IPSec, it’s a work of art."

It's a VPN protocol whose USP is being dramatically simpler than OpenVPN, which should mean that it is both easier to use and more secure (and consensus seems to be that it generally delivers on both of those fronts).

Denvercoder9 5y ago
> It's a VPN protocol whose USP is being dramatically simpler than OpenSSL What? WireGuard is a VPN protocol (and implementation), while OpenSSL is an implementation of TLS. They're not competing with each other, and you can't compare them.
- freedomben 5y ago
  GP probably meant OpenVPN
- cosmosgenius 5y ago
  i think it was meant to be openvpn instead on openssl
- nicoburns 5y ago
  Yep, got the wrong Open* software. Not sure how I managed that.
- deleted 5y ago
  [deleted]
basch 5y ago
dramatically simpler than IPsec. IPSec is Internet Layer, while TLS/SSL (OpenSSL) are Application Layer
- netr0ute 5y ago
  >IPSec is Internet Layer Technically not, since IPSec can also be tunneled over UDP which then turns it into an application layer protocol.
  - perryizgr8 5y ago
    I don't think it works like that. Vxlan can tunnel ethernet frames over UDP, but that doesn't make Ethernet an application layer protocol.
    - shawnz 5y ago
      These semantic issues are why "layers" are a terrible way of classifying network protocols
- hujun 5y ago
  the main reason IPsec is more complex is because it has more features, like multiple CHILD_SA under same tunnel each with different transform and traffic selectors, and also much more authentication choices
  - puzzlingcaptcha 5y ago
    I honestly think "ipsec is too complex" is overdone. Yes, you need to know your networking basics and understand routing but that's probably a good thing when setting up a VPN. Then you pick your crypto primitives from e.g. https://www.keylength.com/en/compare/ https://www.keylength.com/en/compare/ and you are basically done. But no, it's the typical groupthink of 'old is bad' so instead of reading two pages of documentation and having native support across all major platforms people would rather re-invent the wheel.

dsr_ 5y ago

wireguard is a VPN technology that is now integrated into the Linux kernel, and is available on all major platforms. It distinguishes itself from other VPNs by not having knobs to twiddle. Should a security issue arise, it will be necessary to replace it with a wireguard2 or such. This also means that it's very hard to get it wrong in config; either it works or it doesn't, and if it doesn't, you haven't got it working yet. It's very fast and very nice to work with.

deleted 5y ago
[deleted]
Trufa 5y ago
That sounds heavenly. I had never really thought about that immutability like concept, makes a lot of sense for security oriented software.
Sesse__ 5y ago
Wireguard is pretty much half of what you'd expect from a VPN. It does the low-level part (encryption, packetization, session setup, NAT traversal, etc. -- the “actual VPN”) brilliantly, but everything around key distribution is left to external systems. (Tailscale is a popular choice, but by no means the only one.) E.g., you can't connect to vpn.example.com with user foo and password bar and that's it; there needs to be an Ed25519 public/private keypair set up on both sides, an IP address range (essentially a routing table), and so on. Of course, if you want to connect two static networks, wg-quick is all you need. But for the typical “remote worker VPN”, it's pretty much a (great) building block.
- netr0ute 5y ago
  > but everything around key distribution is left to external systems. That's what I'd like, since authentication is usually a pain to set up and with Wireguard, there's none to be done. This also means it's totally stateless and is great for mobile devices where a connection might be broken and crsated again frequently.
- nemosaltat 5y ago

Scaevolus 5y ago

Wireguard is a UDP-based VPN protocol that focuses on simplicity and security. Its Linux implementation is a mere 4000 LOC and the protocol has been formally verified. OpenVPN is over 100,000 lines of code PLUS OpenSSL. https://www.wireguard.com/talks/lpc2018-wireguard-slides.pdf https://www.wireguard.com/talks/lpc2018-wireguard-slides.pdf

TedDoesntTalk 5y ago
It's point-to-point.

stjohnswarts 5y ago

The wikipedia article for it is actually quite informative and not hard to read for the layperson. https://lmwtfy.joe.gl/?q=wireguard https://lmwtfy.joe.gl/?q=wireguard Also Ars had a great article on it as well if you want a readable but more in depth version https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review-fast-connections-amaze-but-windows-support-needs-to-happen/ https://arstechnica.com/gadgets/2018/08/wireguard-vpn-review...

tptacek 5y ago

I think you could reasonably look at WireGuard as a repudiation of previous VPN protocols, almost from root to branch. For instance, WireGuard reconsiders what the role of a VPN "protocol" actually is, and in WireGuard the protocol itself delivers a point-to-point secure tunnel and nothing else, so that the system is composable with multiple different upper-level designs (for instance, how you mesh up with multiple endpoints, or how you authenticate). Another reasonable way to look at WireGuard is that it's the Signal Protocol-era VPN protocol (WireGuard is derived from Trevor Perrin's Noise protocol framework). Notably: WireGuard doesn't attempt to negotiate cryptographic parameters. Instead, they've selected a good set of base primitives (Curve25519, Blake2, ChaPoly) and that's that; if those primitives ever change, they'll version the whole protocol. If you haven't played with it, WireGuard is approximately as hard to set up as an SSH connection. It is really a breath of fresh air.

pkaye 5y ago
Does it use key management like SSH or more like certificates with TLS?
- simcop2387 5y ago
  It's more like client certs with tls that are signed by the server's key I believe.
  - lights0123 5y ago
    Nope. You have a private and public key per connection.
    - psanford 5y ago
      Generally, you have a keypair per host, not per connection.
- Macha 5y ago
  It's like SSH, with no Trust-on-First-Use option. Unlike more complicated pre-existing protocols, how you handle key distribution is explicitly out of scope for the protocol.

phkahler 5y ago

>> What is WireGuard? According to Linus: "...compared to the horrors that are OpenVPN and IPSec, it’s a work of art."