Zinc: a new kernel cryptography API [LWN.net]

Zinc: a new kernel cryptography API

Posted Nov 7, 2018 16:03 UTC (Wed) by bferrell (subscriber, #624)
In reply to: Zinc: a new kernel cryptography API by adam820
Parent article: Zinc: a new kernel cryptography API

VPNs in particular. Crypto isn't very useful if it only works on frubaz systems and nothing else, even if there ARE a lot of frubaz systems. Under those circumstances, it becomes an interesting lab rat.

Zinc: a new kernel cryptography API

Posted Nov 7, 2018 21:25 UTC (Wed) by dtlin (subscriber, #36537) [Link] (1 responses)

For Wireguard in particular, this isn't an issue. There is an officially-supported alternate implementation wireguard-go which works on macos, BSD, iOS, and Android. (There exists a protocol-compatible closed-source implementation for Windows, but ZX2C4 recommends against it.)

Zinc: a new kernel cryptography API

Posted Nov 7, 2018 21:34 UTC (Wed) by bferrell (subscriber, #624) [Link]

Thanks!

I went hunting and it's exactly what I didn't find.

That takes care of that! Even if the page DOES say in effect "don't drink me"

Faster in the kernel

Posted Nov 8, 2018 10:45 UTC (Thu) by tialaramex (subscriber, #21167) [Link]

WireGuard's big claim (which I cannot vouch for) is that it's very _fast_

To be as _fast_ as it can it is implemented as a kernel module, since obviously the kernel is much better able to consume an incoming packet, decrypt it, and spit the plaintext packet out of another interface quickly than a userspace implementation.

But so far as I know WireGuard does not claim "but very slow in, like, userspace". If you use a userspace solution like OpenVPN, or most portable VPN solutions today I would be surprised if the userspace version of WireGuard is slower, indeed my guess would be that it's still faster, just not enough to make people as excited as they are about the kernel module.

WireGuard has some other properties that you may find attractive (I think some of them are a bad idea, but they were done on purpose by smart people and I may yet be proved quite wrong) and for those it doesn't matter whether it's implemented in the kernel, so if these give you a boner then you don't need to care about kernel modules you should download the Go implementation for your BeOS machine or whatever (does Go run on BeOS? Maybe not)

- Like SSH it doesn't come with any actual PKI or anything like that. So this makes it very easy to get started (make key pairs, copy-paste the public keys)
- The crypto is from this century not last century, out of the box, no need to research obscure configuration settings like "dont-use-rot13-encryption" and "allowed-key-size=4096".
- Everything except correctly encrypted messages is ignored. So it's completely invisible to bad guys, this makes your fourteen step SSH port knocking script look like child's play.
- If you're scared about Quantum Computers it has some shared key shenanigans that might in theory save your backside (and doesn't make things worse if, as seems more likely, this is never important at all).
- It's a peer-oriented system, no designated "servers" are needed, although obviously if you want to use it as a normal VPN you will probably ensure a "server" is everybody else's peer.