21 ms·
WireGuard for Windows now uses high speed kernel implementation
- tptacek 5y agoThese are some of the hardest working people in show business.
- optimiz3 5y agoWhat do you mean by show business?
- chamakits 5y agoIt’s an american idiom. Just means they are hard working folks.
- gruez 5y agoIt is? To me it only means "the entertainment industry". This seems to be confirmed by https://en.wiktionary.org/wiki/show_business https://en.wiktionary.org/wiki/show_business
- DoctorOW 5y ago"Show business" means the entertainment industry. "Hardest working in show business" is generic.
- gruez 5y agoSource for this? Searching for "Hardest working in show business" without quotes turns up something relating to an entertainer, and searching it with quotes also returns a bunch of entertainment-related matches.
- sosborn 5y ago> Source for this? American culture for the past 40 years. Seriously, this is a common idiom.
- MikusR 5y agoCan you provide any sources? Google only gives results about a single singer.
- sosborn 5y agoI'm a native speaker that grew up and lives in the U.S. People use it all the time. I don't have any scientific research papers available to show you, but I promise you - this is a common expression.
- optimiz3 5y agoWhat I mean is WireGuard seems like a sincere engineering effort. I'm not sure why it would be called show business which implies fakery.
- danachow 5y agoYou’re missing the boat on this one. It’s an idiom, not taken literally.
- C19is20 5y agoMisunderstandings about water-transport timetables in 3...2... * i'll add that whare i am 'the hardest working folks in show business', is often a compliment: we have our backstage (offices etc), and front of house (dealing with customers) where we have our smiley faces plastered on.
- pvg 5y agohttps://www.youtube.com/watch?v=_BD3zNGauog&t=35s https://www.youtube.com/watch?v=_BD3zNGauog&t=35s
- Groxx 5y ago"show business" is not necessarily derogatory in USA's use. "That's show business" is definitely often used to say "it sucks but that's how things are", but "show business" as a whole is also used to say "this is how the top tier does things, pay attention". Maybe another way to describe it is: Hollywood ("show business" as a whole, but it leaks into popular media in many ways, thus popular [anything]) has a huge presence in both positive and negative ways. As usual in idioms, context is extremely important / often more important than the words themselves. "Show business" is a reference to a highly visible and influential segment of [a population], though often devoid of analysis beyond that point.
- deleted 5y ago[deleted]
- ur-whale 5y agoAfter fighting with OpenVPN for years, I finally switched to Wireguard a while back. Wireguard on Linux is simply amazing, been using it for the last year plus to link all of my devices in a single tunneled LAN, it's been a blast (I can access any of my devices from any of my devices, wherever I or they may be physically located). I do keep one windoze box because I occasionally need to run things that refuse to run on anything but that, and I recently installed wireguard on it ... was expecting headaches ... what do you know, it worked right out of the box, and I can actually securely ssh into the Redmond-spawned contraption from any of my other devices, including my android phone. Wireguard FTW.
- mr337 5y agoI’m in the same boat. I’ve been openvpn for years and finally made the switch and blown away how well it works. All Linux of course.
- wolverine876 5y agoThere's a good description here of what they're doing: https://lists.zx2c4.com/pipermail/wireguard/2021-August/006887.html https://lists.zx2c4.com/pipermail/wireguard/2021-August/0068... I am curious (though happy) about their focus on performance. For most security projects, the specification seems to be 'sufficient' performance and beyond that they invest their limited resources elsewhere. The WireGuard team seems to make it a top priority. Maybe this upgrade was needed to be 'sufficient'? Maybe they see performance as key to adoption? Or maybe they have other reasons. I could see how WireGuard's significant reduction in complexity, compared to other VPN software, could feed performance. It's hard to imagine the Internet without WireGuard, without a VPN I have confidence in. Thank you Jason and team!
- lgierth 5y agoI think performance is just a top priority as security, I remember how in their first whitepaper they already talked about how they batch up packets and stuff like that. Also the whole approach of kernelspace instead of userspace is just for performance. Actually, I think in the beginning there was even a "marketing chart" with throughput numbers in addition to the chart with lines-of-code numbers? Edit: performance being a top priority also makes sense strategically: if you want people to use secure software en-masse, then the experience needs to be stellar in UX and performance as well.
- wolverine876 5y ago> I think performance is just a top priority as security ... That's my impression too. Nothing wrong with it, but I wonder what their thinking is.
- loeg 5y ago> For most security projects, the specification seems to be 'sufficient' performance and beyond that they invest their limited resources elsewhere. I think this impression is basically mistaken, but I'd love to hear about any examples you have in mind.
- 5y ago
- cm2187 5y agoThat should toast OpenVPN in term of performance. I never managed to get more than 5MB/s on OpenVPN on windows, I understand precisely because it wasn't implemented in kernel. I ended up running a pfsense gateway in a VM.
- neilalexander 5y agoIt also doesn’t help that the OpenVPN TAP driver on Windows is utterly abysmal. Wintun (also born out of the Wireguard project) performs significantly better.
- gruez 5y ago>I never managed to get more than 5MB/s on OpenVPN on windows wtf? I can easily get 200 Mb/s on windows, on a commercial VPN provider.
- vbezhenar 5y agoI have the same experience. I control both the OpenVPN server and client. Windows client have abysmal speed. Linux box which is located in the same apartments, can easily saturate the 100 Mb/s link. In the end I switched to IPsec which solved Windows performance issues. These times wireguard seems like a perfect solution, because IPsec configuration with various clients takes too much time.
- cm2187 5y agoI switched to IPsec too, which works great between windows machines, until I tried to make IPSec work between a windows and linux machine! But now all the procols are encrypted (SMB3, RDP, etc). Combine that with an IP while list auto applied to each machine's firewall and I don't think you really need a VPN anymore between your own machines. I only use VPNs for torrents now.
- hansel_der 5y agothere were/are some performance pitfalls with openvpn: * socket-buffer size too small (fixed now) * default fragmentation handling is sub-optimal (needs mssfix) * sheduling priority of the openvpn process too low
- Hamuko 5y agoI'm gonna guess there's no such development planned for macOS given how Apple wants to dump all kernel extensions.
- fortran77 5y agoWindows 10 allows users to have much more control over their hardware--to the point of even letting users choose which hardware and architecture they prefer.
- wtallis 5y agoWindows is willing to run on a much broader range of hardware (though Windows 11 is drastically narrowing that range). But once it's running, Windows really doesn't want to let you have control over your hardware: it lies about the state of the hardware in numerous ways, hides even more information, and especially where power management is concerned it has a clear historical trend of removing control.
- zx2c4 5y agoI would love to work on this, but indeed it won't happen without Apple's blessing. It would be terrific to work with them on this, though!
- BitPirate 5y agoAre you still battling with Apples NetworkExtension framework or are most pain points fixed nowadays? https://lists.zx2c4.com/pipermail/wireguard/2020-December/006226.html https://lists.zx2c4.com/pipermail/wireguard/2020-December/00...
- Jenk 5y agoMy employer use wireguard (perimeter81) - during video conferences (using ms teams) the VPN client goes bananas, occupying some 40-50% of a cpu core - I assume to en/decode the video streams - so I hope this will improve that experience.
- beermonster 5y agoI use WebWRTC based web meetings over WireGuard and don’t have any issues like that.
- Jenk 5y agoTeams swallows an entire core if I have a video conf with more than 3 or 4 others with video active. The Vpn client then uses up half of another. Often I can't do anything with my laptop whilst on one of those calls - including using teams itself because the UI just grinds to a halt. Weirdly it isn't GPU bound at all, my GPU is basically idling the entire time.
- ComodoHacker 5y agoVPN client doesn't decode video.
- Jenk 5y agoI meant that teams is probably using a lot of bandwidth for its (poor choice of) video encoding and the Vpn client is going mental encrypting/decrypting all of that traffic.
- DenisM 5y agoWhatever happened to hardware accelerated encryption? Did it never become a thing?
- tyingq 5y agoThere's AES-NI, on most modern x64 processors, which helps with some Vpn ciphers. But I think Wireguard uses Chacha20 after the key exchanges for most of the traffic, and AES-NI doesn't help with that.
- beermonster 5y agoThe following protocols and primitives are used: ChaCha20 for symmetric encryption, authenticated with Poly1305, using RFC7539's AEAD construction Curve25519 for ECDH BLAKE2s for hashing and keyed hashing, described in RFC7693 SipHash24 for hashtable keys HKDF for key derivation, as described in RFC5869
- vbezhenar 5y agoMy understanding is that modern crypto is fast enough without hardware acceleration, so it's not strictly needed. There are hardware accelerations for AES, SHA algorithms which are slow without acceleration.
- amq 5y agoThere are ChaCha20 SIMD implementations / optimizations for x86, ARM, MIPS and possibly others: - https://patchwork.kernel.org/project/linux-crypto/cover/20181111093630.28107-1-martin@strongswan.org/ https://patchwork.kernel.org/project/linux-crypto/cover/2018... - https://patchwork.kernel.org/project/linux-crypto/patch/20180831080140.20553-1-ebiggers@kernel.org/ https://patchwork.kernel.org/project/linux-crypto/patch/2018... - https://patchwork.kernel.org/project/linux-crypto/patch/20191002141713.31189-6-ard.biesheuvel@linaro.org/ https://patchwork.kernel.org/project/linux-crypto/patch/2019...
- Snawoot 5y agoIn wireguard case it uses Chacha20 with vector instructions, which is almost as performant as AES-NI (and in rare cases even faster).
- captainmuon 5y agoIt's good to see WireGuard getting some love on Windows. Unfortunately it's not for me at the moment and doesn't tick the boxes I need: - Last I checked, dynamic server IPs were not supported - It's system wide by default. With all VPNs, it is relatively difficult to say: use this connection for these applications, or these addresses. Popular VPN apps have per-app-settings, but I find them buggy and not trustworthy. And if you are an expert you can set your own routing of course. But it would be great if you could just right click on a titlebar and say "use VPN for this app", and it was integrated with the OS - There is no obfuscation for hostile environments. I would like a VPN which has pluggable transports, and can, say, look like ssh or http or a game, and route over 20 random servers. I know of shadowsocks etc., but I could never get it to run. - There is no integration with Windows login AFAIK. If you want to log into a Windows AD domain, you need to be in the VPN, but you can't establish connection when you are not logged in. This is really annoying. There is a capability in Windows for this, but I never found a VPN where it works properly. So technically WireGuard is great, security and speed wise, but for me the potential VPN killer application would be defined by superior UX, not by tech.
- c7DJTLrn 5y agoOn your last point, I have a similar problem. I'd like to use WireGuard in a large fleet but the authentication/encryption is just too barebones. You have to generate a keypair for each host and then add that public key to a file on the server. In other words, you can't do it with X509 certificates. I appreciate WireGuard is designed for simplicity but I don't see how it can scale with this limitation.
- phkahler 5y agoOther VPN software will change out their lower layers for wire guard, while keeping things like key management as is.
- stormbrew 5y agoThis is a tempting idea, and maybe it's actually happening, but I do wonder if it's a bit like the hope that git would eventually sprout 'better porcelain' that would obsolete all the clunky bash, perl, etc. scripts that it started out as. In the end most everyone who uses git puts up with the slowly improving 'mainline' porcelain and all the replacements never go anywhere. In particular, I imagine it was important for initial adoption to create the android/ios apps but it really feels like now we're stuck with the kind of clunky (super easy for the user, but super hard to get right for the admin of the network imo) flow they created.
- rastafang 5y agoeven without that, it was probably faster then everything else? I wouldn't know because I avoid Windows...
- Qub3d 5y agoThe previous implementation used Wintun (wintun.net) which was developed originally for Wireguard but spun off into its own layer 3 tunneling driver. And yes, Wintun beats the pants of OpenVPN's TAP driver, but the kernel implementation is even faster yet.
- SLWW 5y agoAnd it's pretty darn mint for the implementation. Best improvement to pair with the best VPN protocol
- segfaultbuserr 5y agoGreat effort, but what is WireGuard's plan on getting a Microsoft signature for their kernel-mode driver? Bypassing the code signing is acceptable for beta testing, but not for production systems.
- MikusR 5y agoI dont remember it asking to bypass anything.
- merb 5y agoyou only need to register with microsoft to sign kernel drivers: https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/ https://docs.microsoft.com/en-us/windows-hardware/drivers/da... they check if you are legit and thats it (basically)