News for hackers. Stuff that matters.

A comment on WireGuardNT, a high-performance WireGuard implementation for the Windows kernel. Parent comment

Re:WireGuardNT, a high-performance WireGuard implementation ... by nicoburns on Monday August 02, 2021 @02:52PM (#28041047)
It's a VPN protocol whose USP is being dramatically simpler than OpenVPN, which should mean that it is both easier to use and more secure (and consensus seems to be that it generally delivers on both of those fronts).
[ Parent | on HN ]
Re:WireGuardNT, a high-performance WireGuard implementation ... by Denvercoder9 on Monday August 02, 2021 @03:23PM (#28041406)
> It's a VPN protocol whose USP is being dramatically simpler than OpenSSL

What? WireGuard is a VPN protocol (and implementation), while OpenSSL is an implementation of TLS. They're not competing with each other, and you can't compare them.

[ Parent | on HN ]
Re:WireGuardNT, a high-performance WireGuard implementation ... by nicoburns on Monday August 02, 2021 @03:31PM (#28041526)
Yep, got the wrong Open* software. Not sure how I managed that.
[ Parent | on HN ]
Re:WireGuardNT, a high-performance WireGuard implementation ... by freedomben on Monday August 02, 2021 @03:29PM (#28041507)
GP probably meant OpenVPN
[ Parent | on HN ]
Re:WireGuardNT, a high-performance WireGuard implementation ... by cosmosgenius on Monday August 02, 2021 @03:30PM (#28041511)
i think it was meant to be openvpn instead on openssl
[ Parent | on HN ]
Re:WireGuardNT, a high-performance WireGuard implementation ... by basch on Monday August 02, 2021 @03:29PM (#28041500)
dramatically simpler than IPsec.

IPSec is Internet Layer, while TLS/SSL (OpenSSL) are Application Layer

[ Parent | on HN ]
Re:WireGuardNT, a high-performance WireGuard implementation ... by hujun on Monday August 02, 2021 @04:29PM (#28042212)
the main reason IPsec is more complex is because it has more features, like multiple CHILD_SA under same tunnel each with different transform and traffic selectors, and also much more authentication choices
[ Parent | on HN ]
Re:WireGuardNT, a high-performance WireGuard implementation ... by puzzlingcaptcha on Monday August 02, 2021 @05:49PM (#28043135)
I honestly think "ipsec is too complex" is overdone. Yes, you need to know your networking basics and understand routing but that's probably a good thing when setting up a VPN. Then you pick your crypto primitives from e.g. https://www.keylength.com/en/compare/ and you are basically done.

But no, it's the typical groupthink of 'old is bad' so instead of reading two pages of documentation and having native support across all major platforms people would rather re-invent the wheel.

[ Parent | on HN ]
Re:WireGuardNT, a high-performance WireGuard implementation ... by netr0ute on Monday August 02, 2021 @04:21PM (#28042112)
>IPSec is Internet Layer

Technically not, since IPSec can also be tunneled over UDP which then turns it into an application layer protocol.

[ Parent | on HN ]
Re:WireGuardNT, a high-performance WireGuard implementation ... by perryizgr8 on Monday August 02, 2021 @09:34PM (#28044790)
I don't think it works like that. Vxlan can tunnel ethernet frames over UDP, but that doesn't make Ethernet an application layer protocol.
[ Parent | on HN ]
Re:WireGuardNT, a high-performance WireGuard implementation ... by shawnz on Tuesday August 03, 2021 @01:27AM (#28045954)
These semantic issues are why "layers" are a terrible way of classifying network protocols
[ Parent | on HN ]