News for hackers. Stuff that matters.
Re:Identity management for WireGuard networks by tptacek on Wednesday October 19, 2022 @02:47PM (#33266287)
First, even with third-party code, WireGuard is going to be significantly smaller than OpenVPN (and significantly easier to audit).

But more importantly, you can't just count lines of code as if they're all equivalent. There's a trusted core of code that is more important than the rest of the code, and WireGuard's trusted code is microscopic compared to OpenVPN. That's the right word in this case: "microscopic". It's some of the easiest code in the whole kernel to read, even given the cryptography.

Re:Identity management for WireGuard networks by tssva on Wednesday October 19, 2022 @03:46PM (#33267075)
"First, even with third-party code, WireGuard is going to be significantly smaller than OpenVPN (and significantly easier to audit)."

Do you have some evidence for that or is it just speculation?

"But more importantly, you can't just count lines of code as if they're all equivalent."

You're right but the Wireguard white paper conclusion claims an advantage for Wireguard based solely upon the lines of code needed to implement.

OpenVPN, Wireguard and IPsec all have their advantages and disadvantages. I have and will use all 3 where appropriate based upon them.

Re:Identity management for WireGuard networks by tptacek on Wednesday October 19, 2022 @04:21PM (#33267476)
Yes, there is plenty of evidence for this; see for instance the WireGuard paper. Numerous code size comparisons have been done here.

Further, that is not what the WireGuard paper concludes. For instance: the paper makes a note of the fact that WireGuard is designed to be implemented without dynamic memory allocation, which is not a function of lines of code (in fact, it probably adds lines of code).

You do you, but as a practitioner in this space, I'd say using OpenVPN or IPSEC in 2022 without some powerful compatibility, regulatory, or network complexity concern to support it is malpractice. You might disagree, but I think you'd be in the minority of security engineers on the point. Feel free to ask around! The codebases for OpenVPN and the IPSECs are reviled.

Re:Identity management for WireGuard networks by tssva on Wednesday October 19, 2022 @07:06PM (#33268947)
Plenty of code size comparisons with Wireguard and 3rd party apps providing feature parity with OpenVPN? Can you provide some links?

The Wireguard paper makes notes of many things including the lines of code needed to implement.

"I'd say using OpenVPN or IPSEC in 2022 without some powerful compatibility, regulatory, or network complexity concern to support it is malpractice."

Life is complicated and those type of concerns are almost always in play which means OpenVPN and IPsec are also always in play. Wireguard is great where it is a fit but there are characteristics of Wireguard which also make it the more complicated and fragile solution in some circumstances.

Re:Identity management for WireGuard networks by pvg on Wednesday October 19, 2022 @08:25PM (#33269473)
You were asking whether Wireguard's design goals and criteria still hold up and the answer to that is that they do.
Re:Identity management for WireGuard networks by tssva on Monday October 24, 2022 @12:38PM (#33318973)
I never asked that! I said it would be interesting to see how the line count of Wireguard and the 3rd party software needed to bring it in feature parity with OpenVPN compared with OpenVPN since the line count of Wireguard by itself is touted as an advantage.
Re:Identity management for WireGuard networks by pvg on Tuesday October 25, 2022 @09:16AM (#33330054)
It's not 'touted as an advantage' based on line count alone and the 'feature parity' thing doesn't apply as explained in the comments above.
Re:Identity management for WireGuard networks by stoplying1 on Wednesday October 19, 2022 @11:04PM (#33270355)
The hand waving and moving goalposts would be less glaring if you, you know, mention a single use case where WG is supposedly the inferior solution?
Re:Identity management for WireGuard networks by tssva on Monday October 24, 2022 @12:47PM (#33319086)
What hand waving and moving of goalposts it that? All I stated was that it would be interesting to see a comparison of line count of Wireguard and the 3rd party tools needed to bring it into feature parity with OpenVPN to the line count of OpenVPN. My above comment just asked for references to studies doing just that which the comment I was responding to claimed to exist.
Re:Identity management for WireGuard networks by usernom on Thursday October 20, 2022 @02:53PM (#33279022)
Large organizations sometimes use Strongswan bc it has stuff like CAs integrated. (Ok, it's using IPsec, but that's still not OpenVPN)