On 2026/09/07 15:58, Zack Newman wrote:
> WireGuard pads plaintext such that its length is a multiple of 16[^1].
> This means the default MTU should be based on the following equation:
> 
> M = P + IP header + UDP header + WireGuard message header + Poly1305 tag
>   = P + 20/40 + 8 + 16 + 16 = P + 20/40 + 40 = P + 60/80
> 
> where M is the MTU of the physical connection and P is the length of the
> ciphertext.
> 
> Since ChaCha20 is a stream cipher, P is also the length of the padded
> plaintext which is a multiple of 16 as previously stated.
> 
> To play it safe, assume M is the standard Ethernet MTU of 1500 and IPv6
> is used; then P = max{16q | 16q <= 1420} = 1408. If IPv4 were assumed,
> then P = max{16q | 16q <= 1440} = 1440; so the default would be 1440 in
> that situation.
> 
> I believe this is the cause of the recent issue[^2] I started
> experiencing.
> 
> Is there something wrong with my reasoning?
> 
> [^1]: https://github.com/openbsd/src/blob/master/sys/net/if_wg.c#L1594
> [^2]: https://marc.info/?l=openbsd-misc&m=178871489727665&w=2
> 

1420 is the default for afaik all WireGuard implementations (including
of course existing OpenBSD versions), I think diverging from this is
likely to cause more problems than it'd solve