OmniEdge – an Open source P2P layer 2 VPN infrastructure based on n2n protocol

Re:OmniEdge – an Open source P2P layer 2 VPN infrastructure ... by api on Thursday August 04, 2022 @01:04PM (#32345490)

> Twofish/AES128/ChaCha20

Supporting Twofish is really bizarre. It's basically dead and would be slow compared to AES or ChaCha unless someone rolled their own SIMD implementation (why?). AES128 is weird too since 128-bit key ciphers are kind of deprecated unless your target is a fridge magnet.

AES256 or ChaCha20 would be sane as they are both roughly equivalent security-wise (in practice, people will debate theory) and both still recommended for use in new stuff, but most cryptographers would recommend that you pick one and only one of these two for a new system unless something forces you to support both.

So yeah, weirdness abounds here.

[ Parent | on HN ]

Re:OmniEdge – an Open source P2P layer 2 VPN infrastructure ... by sdeziel on Thursday August 04, 2022 @04:47PM (#32348119)

> AES128 is weird too since 128-bit key ciphers are kind of deprecated unless your target is a fridge magnet.

Why is AES128 preferred over AES256 by browsers then?

https://www.ssllabs.com/ssltest/viewClient.html?name=Chrome&... https://www.ssllabs.com/ssltest/viewClient.html?name=Firefox...

[ Parent | on HN ]

Re:OmniEdge – an Open source P2P layer 2 VPN infrastructure ... by RL_Quine on Thursday August 04, 2022 @05:25PM (#32348484)

Technically it's slower, but absolutely meaninglessly so in the context of browsers.

[ Parent | on HN ]

Re:OmniEdge – an Open source P2P layer 2 VPN infrastructure ... by RL_Quine on Thursday August 04, 2022 @01:07PM (#32345514)

Agreed. It's also super weird to have designed a new protocol that supports multiple cipher suites, it's very well established through the design of SSL and SSH now that there is absolutely no place for cipher negotiation in protocols.

[ Parent | on HN ]

Re:OmniEdge – an Open source P2P layer 2 VPN infrastructure ... by api on Thursday August 04, 2022 @01:12PM (#32345575)

Yeah, right now any new protocol should pick either ChaCha if you want to be fast on general purpose hardware and/or be hipster certified or AES (256) if you want to be fast on AES accelerated hardware and/or be FIPS(ter?) certified. I can't think of a single reason to pick anything else right now or to support negotiation.

[ Parent | on HN ]

Re:OmniEdge – an Open source P2P layer 2 VPN infrastructure ... by RL_Quine on Thursday August 04, 2022 @01:14PM (#32345593)

The reason negotiation is in this product is that the underlying code is actually from 2008, which explains why the cipher selection exists in the protocol, as well as the inclusion of TwoFish.

[ Parent | on HN ]