3 ms·

Not trying to diminish it's importance, however isn't it slightly sad how much total payload is devoted to encryption? Also, and I know this is slightly pedan

Not trying to diminish it's importance, however isn't it slightly sad how much total payload is devoted to encryption? Also, and I know this is slightly pedantic, but this is only speaking to layer 7. If you really wanted to watch everything byte by byte you'd need everything upwards of layer 2 where we go from bits on wire to bytes and frames. If you've not used Wireshark before run it yourself and load some pages.

tomtomtom777 3y ago
I don't think much is wasted on encryption. Most is wasted on backwards compatibility in the form of negotiating protocols, algorithm, extenstions, etc. If there would forever be only one encryption algorithm in use we we wouldn't need most of the stuff.
- segfaultbuserr 3y ago
  > If there would forever be only one encryption algorithm in use we we wouldn't need most of the stuff. Coincidentally, this is why a protocol like WireGuard is much simpler than OpenVPN. It's a clean-sheet design, so its developers had the luxury to design it with hardcoded modern crypto primitives without any revision or extension. Protocol negotiation is skipped entirely since it's often error-prone and suspect to attacks...
  - diarrhea 3y ago
    How will we go to newer Wireguard versions then? Throw it all away and use a wholly new product? Or have a Wireguard 2.0, where all participants need to upgrade in lockstep, with no backwards compatibility (actually sounds attractive: some churn from time to time, but none of the avoidable headaches)?
    - segfaultbuserr 3y ago
      > Or have a Wireguard 2.0, where all participants need to upgrade in lockstep, with no backwards compatibility (actually sounds attractive: some churn from time to time, but none of the avoidable headaches)? I think it's basically the plan. Even with protocol negotiation, replacing an existing crypto algorithm would be a breaking change anyway. Furthermore, it should be possible to preserve backward compatibility using a reserved field without a heavy-weight, full-fledged protocol negotiation. Entering a different code path if the message is tagged "version 2" should be enough.
MichaelZuo 3y ago
Yeah, I'm pretty sure this is not the byte stream as seen by the ethernet port or Wifi/Cellular antenna. So it's quite a misleading title if the reader takes 'byte by byte' literally.

tomtomtom777 3y ago

I don't think much is wasted on encryption. Most is wasted on backwards compatibility in the form of negotiating protocols, algorithm, extenstions, etc. If there would forever be only one encryption algorithm in use we we wouldn't need most of the stuff.

segfaultbuserr 3y ago
> If there would forever be only one encryption algorithm in use we we wouldn't need most of the stuff. Coincidentally, this is why a protocol like WireGuard is much simpler than OpenVPN. It's a clean-sheet design, so its developers had the luxury to design it with hardcoded modern crypto primitives without any revision or extension. Protocol negotiation is skipped entirely since it's often error-prone and suspect to attacks...
- diarrhea 3y ago
  How will we go to newer Wireguard versions then? Throw it all away and use a wholly new product? Or have a Wireguard 2.0, where all participants need to upgrade in lockstep, with no backwards compatibility (actually sounds attractive: some churn from time to time, but none of the avoidable headaches)?
  - segfaultbuserr 3y ago
    > Or have a Wireguard 2.0, where all participants need to upgrade in lockstep, with no backwards compatibility (actually sounds attractive: some churn from time to time, but none of the avoidable headaches)? I think it's basically the plan. Even with protocol negotiation, replacing an existing crypto algorithm would be a breaking change anyway. Furthermore, it should be possible to preserve backward compatibility using a reserved field without a heavy-weight, full-fledged protocol negotiation. Entering a different code path if the message is tagged "version 2" should be enough.

MichaelZuo 3y ago

Yeah, I'm pretty sure this is not the byte stream as seen by the ethernet port or Wifi/Cellular antenna. So it's quite a misleading title if the reader takes 'byte by byte' literally.