Hacker News Reader

Comment by hnspammers | Hacker News Reader

I’ll need someone more into this to break it down for me - how does VPN work on this and why do you need an FPGA version of it? Is this an internal VPN or one for connecting to the internet?

View on HN

This part of the README answers the “why” pretty well:

> Both software and hardware implementations of Wireguard already exist. However, the software performance is far below the speed of wire.

> Existing hardware approaches are both prohibitively expensive and based on proprietary, closed-source IP blocks and tools.

> The intent of this project is to bridge these gaps with an FPGA open-source implementation of Wireguard, written in SystemVerilog HDL.

So having it on an FPGA gives you the best of both worlds, speed of a hardware implementation without the concerns of a proprietary black box.

Unless you physically build the FPGA, you still have a black box, but you just shifted the problem (now, I am not saying that this is a bad thing, since if you run Linux on Intel, it's still proprietary and people still run Linux).

"VPN" is just virtual emulated network cables that you would use to connect your laptops to Wi-Fi routers. It's just so happens that a lot of companies use that word for a paid, cloud based Internet-over-Internet service. It's as if taxi companies called themselves "wheels" companies that whether you're referring to the physical object or the service had become ambiguous.

VPNs are normally processed in software, and that processing is usually multi-step. So latency, jitter, processing time per types of packets, etc can vary. This is FPGA based, and FPGA can run some algorithms and programs that can be implemented as chained conditions at fixed latency without relying on function calling in software. Presumably this is faster and more stable than software approaches thanks to that.

Just a guess but I assume that this is (or rather, would be, judging by the README this isn't past the planning stage) for IoT and the like.

If you want your device to connect to a VPN you need something to implement the protocol. Cycles are precious in the embedded world so you don't want to do it in your microcontroller. You might offload it to another uC in your design but at that point it might make sense to just use an FPGA and have this at the hardware(-ish) level.

You can think of this as a "network interface chip" but speaking Wireguard instead of plain IP.

Not a member of the project but here is my take:

You run the WireGuard app on your computer/phone, tap Connect, and it creates an encrypted tunnel to a small network box (the “FPGA gateway”) at your office or in the cloud. From then on, your apps behave as if you’re on the company network, even if you’re at home or traveling.

Why the FPGA box: Because software implementations are too slow and existing hardware implementations cost too much.

Internal or Internet: Both.

Wireguard is a protocol and program for making point-to-point VPN connections. It's notable because it's simple (compared to alternatives like OpenVPN), so simple it became a kernel module which made it very fast. These guys implemented it in an FPGA because they could.

i think of wg more as point-to-point, encrypted network interfaces cards than a vpn.

That's what a vpn is - a virtual private network.

You can make a private network by adding more network interface cards and wiring. If you do it with software instead, it's virtual.

integration of some of the compute intensive bits into the nic itself. the reason to do it in hardware is to increase efficiency (or sometimes performance, although software/cpu wireguard is already pretty good). this could be baby steps towards lower power / miniaturized / efficient hardware that supports the wireguard protocol.

also just a fun project for the authors. :)

Reply on news.ycombinator.com