18 ms·
SigmaVPN: Stateless OpenVPN Replacement Using NaCl Encryption Library
- dagi3d 13y agothe source code is about two years old. does that mean that the code is so stable that there is no need for patches/improvements? or has the project been discontinued?
- jedisct1 13y agoQuicktun is still maintained: https://github.com/UCIS/QuickTun https://github.com/UCIS/QuickTun
- pipeep 13y agoI'm very impressed with how short and clean the code. I did a very quick code review, and things appear to be implemented sanely (eg, they drop permissions and chroot properly). There aren't many comments, but most of the code is readable enough without it. I don't care much for their coding style (little whitespace, long lines) but that's just aesthetics. More importantly, QuickTun might have some usability issues. Port numbers are hard-coded, and most configuration options seem to be set as environment variables. This should be expected though, as a result of trying to keep the code as small as possible. I'd recommend it, but only to someone who's willing to read the source to figure out what's going on. If someone wanted to write their own VPN, it would be an excellent reference. It's definitely not for everyone.
- aryastark 13y agoQuicktun used to use C's rand() to generate keypairs (see keypair.c). They still include a blurb about /dev/urandom being insecure and apparently requiring the user to manually input random data. The nacl0 protocol is inherently insecure (null nonce, vulnerable to replay), not sure why they even include that. IIRC, you also pass the private key via environment variable. Lots of horrible flaws for such a small code base.
- zokier 13y agoSo is SigmaVPN a wrapper to QuickTun or what is the relation here? What do I miss if I use plain quicktun instead of sigmavpn?
- j_s 13y agoAlso, does not support Windows
- mrsaint 13y agoyeah, I am surprised by that, too. Haven't heard about this one until now... and I have had my fair share with various VPN implementations, from OpenVPN to Strongswan.
- zx2c4 13y agoAnybody familiar with this project? Does it successfully and securely achieve what it claims to achieve? What's its status currently?
- alrs 13y agoI'm glad someone is coming at this problem from a different angle. Maybe the subtext to this submission is "OpenSSL totally sucks so bad you need to evacuate NOW NOW NOW!!!!" If so, I'd point out that now is the time to upgrade OpenSSL, ditch all of your old keys, and keep an eye on the future. Today is not the day to forklift in a whole new chunk of infrastructure. Instead, set up a lab, play with it, get a feeling for it.
- deleted 13y ago[deleted]
- agl 13y agoIt's encouraged with NaCl to cache the results of the Diffie-Hellman operation. Thus the protocol can be conceptually stateless, but the cache solves the problem of having to do per-packet, public-key operations. From a quick skim of the code, it does appear that they might be doing this. They are calling the right functions for it (crypto_box_curve25519xsalsa20poly1305_afternm. (See "C precomputation interface" in http://nacl.cr.yp.to/box.html http://nacl.cr.yp.to/box.html)
- deleted 13y ago[deleted]
- agl 13y agoI've not looked at the actual protocol, but it's not impossible. If we assume every packet contains the client's (random, generated at process start) public key then the server could (in theory) perform key-agreement for every packet, decrypt it and handle it. In practice, it would cache the result so that it only does one key-agreement operation per client. If the server crashes (did you have the server in mind when you said "other side"?) then it looses its cache, but the first packet that the new instance of the server sees will have the client's public key in it so it just refills its cache immediately.
- tptacek 13y agoOne of the goals behind the primitives NaCl selected was per-packet public key crypto.
- revelation 13y agoAs DJB noted in the very presentation he introduced NaCl, public key crypto for all data is in fact very feasible on todays hardware.
- borski 13y agoFWIW, we built an incredibly easy single click OpenVPN setup tool for DigitalOcean and Rackspace during Sochi: http://www.tinfoilsecurity.com/vpn http://www.tinfoilsecurity.com/vpn Enter API key creds, it makes the box for you, sets it up, and hands you a config you can use for your client of choice. (The script is open source for those of you that don't want to enter creds - we don't store them, and actually remove access whenever we can; for example, we delete our own SSH key from DO because they let us). It's still OpenVPN but might be useful to those that care about this story too.
- mrfusion 13y agoThis is such a nice product, I'm thinking you should be charging for it! I can't quite so who the market would be though. I guess there's not an easy way to target it to the enterprise market.
- jrvarela56 13y agoI've been thinking of how to market this but the only step missing is setting up the client. Bear in mind that this should be fool proof (typed up the instructions for a friend and still ended up with 8-10 steps). Tunnelblick for OSX is straightforward to setup with the provided .ovpn file but takes too many steps.
- borski 13y agoThanks for the kind words - our main business is website security testing (check out our homepage at https://www.tinfoilsecurity.com https://www.tinfoilsecurity.com) and we built this mostly for our customers to use to keep themselves safe. :)
- _mikz 13y agoReplacement? Does it talk OpenVPN protocol? No. It is not a replacement.
- StavrosK 13y agoIt's not a clone. It's a replacement. It does the same job, like the car is a replacement for the horse-drawn carriage, but it doesn't run on hay.
- tptacek 13y agoThis code is as simple as the project owners say it is, but a couple things about it that I wish were different: * The "nacltai" protocol driver uses C VLAs to store attacker-controlled numbers of bytes; a VLA is morally the same as an "alloca" call. I have no clue if this is exploitable but reading it gives me a painful burning itching sensation. * I sort of wish the authors didn't parse strings to recover crypto parameters from the packets, but instead just used a straightforward binary encoding that would require less use of C's terrible string functions. I'm still a lot more comfortable with this codebase than with OpenVPN. :)
- pbsd 13y agoCurious; VLAs are also one of my main pet peeves with NaCl's bundled C++ wrapper. You can't convincingly argue that it's to prevent memory allocations, since everything is passed and returned as std::string. Additionally, VLAs are not even in the C++ standard.
- zanny 13y agoThey should be, soon, though. Which is great. I think the last proposal was for dynarray. See here: http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2008/n2648.html http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2008/n264... Some compilers already support the spec, even if it isn't going to be in C++14.
- barnslig 13y agoThere's another tunnel implementation that's based on NaCl called fastd. It seems to be production ready, however some thousands of Freifunk participants use it to connect their Access Points. https://projects.universe-factory.net/projects/fastd/wiki https://projects.universe-factory.net/projects/fastd/wiki
- stormbrew 13y agoThis looks promising, but I don't feel good about the fact their SSL cert isn't valid. :/
- doe88 13y agoMaybe someone can help me, it is said It has a time-based nonce, which provides built-in resistance against replay attacks, I'm looking where in the code the time-based nonce is verified/handled on the receiver, but I can't find it. What I see: when a packet is decrypted the time-based nonce is unpacked here [1] and this function seems to be called from here [2] but nowhere I can't find where this nonce is verified not to be too old, what am I missing? [1] https://github.com/neilalexander/sigmavpn/blob/c7f60ecfdb22badae819fa965bc657286983c391/proto/proto_nacltai.c#L247 https://github.com/neilalexander/sigmavpn/blob/c7f60ecfdb22b... [2] https://github.com/neilalexander/sigmavpn/blob/c7f60ecfdb22badae819fa965bc657286983c391/main.c#L423 https://github.com/neilalexander/sigmavpn/blob/c7f60ecfdb22b...
- nodata 13y agohttps://news.ycombinator.com/item?id=7599941 https://news.ycombinator.com/item?id=7599941
- onedognight 13y agoThis is a real bug. You can see that in the code[0] this was based on that they do at least check the nonce/timestamp. [0] https://github.com/UCIS/QuickTun/blob/master/src/proto.nacltai.c#L99-L102 https://github.com/UCIS/QuickTun/blob/master/src/proto.naclt...
- neilalexander 13y agoYou are correct about this, and I have updated the code to include the replay protection. (Apparently I became sidetracked before!) I am not sure if the method that is used in the quicktun source to prevent replay is ideal, and I am fairly certain that I need to revise the method used to generate the nonce too.
- zobzu 13y agoisnt openvpn stateless if you disable the ping restarts anyway?
- api 13y agoThis is stateless, nearly zero-configuration, and P2P, among other things. It also uses the same cryptographic primitives and composition as NaCl (purely coincidentally). It supports Mac, Windows, and Linux, and has a GUI control panel for Mac and Windows. There's a clean installer with baked-in auto-update functionality. https://github.com/zerotier/ZeroTierOne https://github.com/zerotier/ZeroTierOne /full disclosure: I wrote this.
- tinco 13y agoCould you add some example networks on your frontpage? Preferably with nice network diagrams. It could help sell your product if people know what kind of business cases it helps for (my business is looking for a good solution). Also, please use something like twitter's bootstrap and buy a nice theme, your site and logo currently look like very untrustworthy. I couldn't get my boss to sign off buying something from a website that looks like that.
- api 13y agoI completely agree on the design. I'm working on a big web design rev right now that looks much better. I'm not sure what you mean by diagrams though. This doesn't work that way. It creates virtual networks that look completely flat, as if you and every other peer were plugged into the same Ethernet switch. One of my difficulties has been getting this across... you don't have to think about topology. It's easier than that. It's a virtual switch. Install, join network, done. Everything is automatic. You can peek at the new design here (but don't try to use it): https://test.zerotier.com/ https://test.zerotier.com/
- tinco 13y agoThat design is a lot better. But I'd still recommend you look a little more at some professional themes. Also the logo could use some typographic love :) But a network in which every peer is connected to the same ethernet switch isn't flat, it's a star. But a star network doesn't scale as well as you claim. Behind the scenes to make it scalable perhaps you build p2p connections, this would make the diagram be more like a complete graph, which it has its own scaling problems. To solve it, perhaps you have stateless or on-demand connections, so the actual number of connections is lower than the worst case. Or perhaps you promote peers to super-peers and build a stars of stars network. A couple of simple diagrams answer these questions and quickly let me decide whether your solution is suitable.
- alexnewman 13y agoLOL for anyone who uses this.
- archivator 13y agoWhat's the recommended non-serious-personal-use VPN these days? PPTP is completely broken (MS-CHAPv2 especially), OpenVPN is hard to setup and maintain. I've been using ssh as an impromptu VPN-like thing but I'd really, really like an actual VPN solution.
- stormbrew 13y agoI use n2n for things that don't really matter, it's quite nice and simple, but has some pretty glaring potential if not real security flaws in its design (and the v2 that was supposed to fix some of them seems to be in some kind of deep technical debt hole and tends to crash). After this thread I'll be looking at fastd and zerotierone, though.
- uuid_to_string 13y agoWhat do you use for things that matter? Do you have something else to create L2 overlays that is more secure?
- stormbrew 13y agoUnfortunately, openvpn. :/
- uuid_to_string 13y agoAs you know, OpenVPN cannot do what n2n can do. Someone has to run an OpenVPN server. Everyone on the network has to trust that server. And connections between network participants are not peer to peer. With OpenVPN and most other VPN's, if I'm not mistaken, each person's traffic passes through a central point: some VPN server/appliance. This is a major difference and has its own set of security implications.
- atmosx 13y ago> OpenVPN is hard to setup and maintain. That's not true. OpenVPN is the easier, most straight-forward solution when it comes to set-up[1] and configuration (routing, firewalling, client auth, etc.). Try to setup OpenSWAN and you'll see what hard to setup really means. I don't know about new software like SigmaVPN. [1] Or maybe I am too used to it.
- uuid_to_string 13y agohttp://curveprotect.org/howto-vpn.html http://curveprotect.org/howto-vpn.html
- dmourati 13y agoLink bait title with reference to OpenVPN but not mentioned anywhere on the page.
- darklajid 13y agoI'm still searching for something a la tinc, but with a decent crypto story (tinc goes out of its way to say that it probably isn't safe). SigmaVPN would look awesome, but lacks Windows support. I'd give ZeroTierOne a shot, but that lacks Android support. Any other solutions for a "VPN Of Things" if you will?
- pelasaco 13y agokind of interesting the build system https://github.com/neilalexander/sigmavpn/blob/master/build.sh https://github.com/neilalexander/sigmavpn/blob/master/build.... and https://github.com/neilalexander/sigmavpn/blob/master/install.sh. https://github.com/neilalexander/sigmavpn/blob/master/instal.... no make, cmake or scons.. im wondering how they are dealing with different platform and requirements checking...