A NetBSD projekt fejlesztői A NetBSD kernel that includes the wg driver implementing the WireGuard protocol has been introduced. NetBSD has become the third OS after Linux and OpenBSD to integrate support for WireGuard. Also proposed are auxiliary commands for VPN configuration – wg-keygen and wgconfig. In the default kernel configuration (GENERIC), the driver is not yet activated and requires explicit specification in the settings "pseudo-device wg".
További megjegyzésként The corrective update for the wireguard-tools package 1.0.20200820 includes user-space utilities such as wg and wg-quick. The new release has prepared IPC for the upcoming support of WireGuard in the FreeBSD operating system. There has been a separation into different files for platform-specific code. Added to the unit file for systemd is support for the "reload" command, allowing constructs like "systemctl reload wg-quick at wgnet0" to be executed.
It should be noted that the WireGuard VPN is based on modern encryption methods, providing very high performance, ease of use, and has proven itself well in several large implementations handling significant traffic volumes. The project has been developing since 2015, passed an audit and of the applied encryption methods. Support for WireGuard is already integrated into NetworkManager and systemd, and the kernel patches are included in the core distributions , Mageia, Alpine, Arch, Gentoo, OpenWrt, NixOS, és .
WireGuard employs a key routing concept that ties a private key to each network interface and uses it to connect with public keys. The exchange of public keys for connection establishment occurs similarly to SSH. For key agreement and connection without launching a separate user-space daemon, the Noise_IK mechanism from , similar to maintaining authorized_keys in SSH, is applied. Data transmission is done through encapsulation in UDP packets. The VPN server IP address can change (roaming) without interrupting the connection, with automatic client reconfiguration.
For encryption a stream cipher and a message authentication algorithm (MAC) , developed by Daniel Bernstein (), Tanja Lange
(Tanja Lange) és Peter Schwabe. A ChaCha20 és a Poly1305 gyorsabb és biztonságosabb alternatívái az AES-256-CTR-nek és a HMAC-nek, amelyek szoftveres megvalósítása lehetővé teszi az állandó végrehajtási idő elérését, anélkül hogy külön hardvert igényelne. A közös titkos kulcs generálásához elliptikus görbéken alapuló Diffie-Hellman protokollt alkalmaznak. , amelyet Daniel Bernstein is javasolt. A hash-eléshez a következő algoritmust használják: .
Forrás: opennet.ru
