zx2c4

39 ms·

361.
“CPUs are optimized for video games”(moderncrypto.org)
434 points by zx2c4 10y ago|336 comments
362.
by zx2c4 10y ago
Here's the commit for fixing this: https://git.zx2c4.com/linux/commit/?id=75ff39ccc1bd5d3c455b6...
363.
WireGuard: Routing and Network Namespace Integration(wireguard.io)
2 points by zx2c4 10y ago|0 comments
364.
by zx2c4 10y ago
Unless you're comparing gzipped CSS (base64, I mean) to a gzipped font file, in which case, the size isn't recovered. zx2c4@thinkpad ~ $ gzip Ovo-Regular.ttf zx2c4@thinkpad ~ $ stat Ovo-Regular.ttf.gz File: &#x27
365.
by zx2c4 10y ago
Have you got a smartcard that will do X25519? If so I'd be quite interested to learn which one. Sounds fun to play with.
366.
by zx2c4 10y ago
The client is identified by the public key only. Two clients behind the same NAT can connect to the same server, no problemo.
367.
by zx2c4 10y ago
I think I have this board laying around actually. A friend is working on OpenWRT packages so some benchmarking on there should be around the corner.
368.
by zx2c4 10y ago
The cipher suite is part of the Noise preamble, so all operations are crytographically bound to the cipher suite to prevent against related-algo attacks. WireGuard itself has no plans for cipher agility, something that is considered an anti
369.
by zx2c4 10y ago
Your concern (1) is valid, but fortunately that's an over-simplification in the casual introduction part of documentation, which I'll fix. Sorry about that. This should read more like, "Encrypt entire IP packet using the symm
370.
by zx2c4 10y ago
Replay attacks don't work because of the nonce, so that's handled successfully. But an attacker with an active man in the middle position might change the outer (unencrypted) src IP of a packet. However, that src will need to be
371.
by zx2c4 10y ago
I answered this question elsewhere. The answer is that - probably, why not? I need to think about it for more than a few seconds. But the only reason I chose GPLv2 is because that's what Linux uses. I'll quit being lazy and think
372.
by zx2c4 10y ago
Join the mailing list! https://lists.zx2c4.com/mailman/listinfo/wireguard And if you're savvy and want to get involved with development, we need all the help we can find!
373.
by zx2c4 10y ago
I love DPDK. Super fun. I've actually made a few projects with it. But this is for creating closed network systems, not for integrating into Linux's networking infrastructure. If somebody would like to produce a WireGuard implemen
374.
by zx2c4 10y ago
Answered in this thread here: https://news.ycombinator.com/item?id=11995389
375.
by zx2c4 10y ago
Because it's necessary for any reasonable performance. If you're concerned about this, you might have several heart attacks when you look at the obscene amount of code that IPsec has in the kernel. IPsec is the only other alternat
376.
by zx2c4 10y ago
WireGuard is UDP only. For TCP or SSL tunneling, look at a million other things that already do this.
377.
by zx2c4 10y ago
Faster, more secure, and works quite well with mobile thanks to built-in roaming.
378.
by zx2c4 10y ago
> How do you deal with MTU? OpenVPN's handing is particularly bad [1]? MTU is dealt with the same way as other kernel space tunneling devices. > Is the whole protocol in-kernel or just the data plane? All of it, which is why ther
379.
by zx2c4 10y ago
ChaPoly is based on Martin Willi's implementation, but heavily modified. Blake2s is essentially their reference code. Curve25519 is based on Adam Langley's donna.
380.
by zx2c4 10y ago
> Just remember to aid others' verification efforts later on by keeping it modular, minimal shared state, simple constructions in code, and so on. Whatever passes through a decent static analysis tool. Yes this absolutely is the goa
381.
by zx2c4 10y ago
IPv6 definitely is supported. I should add some examples. Every place you see an IPv4 address an IPv6 one can go. They can even be mixed and matched. There's full support and it works quite well. Thanks for the documentation suggestion
382.
by zx2c4 10y ago
As mentioned in the roadmap and the cross-platform page, we're working on a cross-platform userspace client, so Mac and Windows users can use it too. It's in the works!
383.
by zx2c4 10y ago
> Does the server get a separate wg interface for every client that connects? No. Each wg interface has a public/private key. It then has a list of peers' public keys and associated allowed IPs. By tying each public key to the
384.
by zx2c4 10y ago
Endpoint IPs are learned based on successfully authenticated/decrypted packets. The Endpoint= entry in the config is just the location of an initial server endpoint. Inner tunnel IPs are fixed in the config, and it's up to things
385.
by zx2c4 10y ago
I don't really have any problem re-licensing it less restrictively, I don't think. I'll have to think about it for more than 10 seconds I suppose. But I put "GPLv2" there without much thought simply because that&#x2
386.
by zx2c4 10y ago
We'll actually be producing a Rust implementation for userspace. It'd be interesting to see that work ported back to kernelspace. Cool suggestions.
387.
by zx2c4 10y ago
WireGuard as a simple associations between public keys and each public keys list of allowed IPs. Within this structure, it seems like you should be able to do what you want.
388.
by zx2c4 10y ago
Speed, simplicity. It's not possible to do highspeed crypto from userspace while still integrating with the usual networking stack. Tun devices result in copies and context switches which makes things quite slow. This also adds quite a
389.
by zx2c4 10y ago
Oh cool you came to the kernel recipes talk. Much has progressed since then. I wrote an email on LKML and netdev today to David Miller, the network subsystem maintainer. It's not ready for a [PATCH] set now, but it is ready to get init
390.
by zx2c4 10y ago
Wow, I launched this 10 minutes ago and somebody already put it on Hacker News. Spectacular! I'm the author of this and would be happy to answer any questions you have.

More ›