In this paper we present PQ-WireGuard, a post-quantum variant of the handshake in the WireGuard VPN protocol (NDSS 2017). Unlike most previous work on post-quantum security for real-world protocols, this variant does not only consider post-quantum confidentiality (or forward secrecy) but also post-quantum authentication. To achieve this, we replace the Diffie-Hellman-based handshake by a more generic approach only using key-encapsulation mechanisms (KEMs). We establish security of PQ-WireGuard, adapting the security proofs for WireGuard in the symbolic model and in the standard model to our construction. We then instantiate this generic construction with concrete post-quantum secure KEMs, which we carefully select to achieve high security and speed. We demonstrate competitiveness of PQ-WireGuard presenting extensive bench-marking results comparing to widely deployed VPN solutions.
In this paper we present PQ-WireGuard, a post-quantum variant of the handshake in the WireGuard VPN protocol (NDSS 2017). Unlike most previous work on post-quantum security for real-world protocols, this variant does not only consider post-quantum confidentiality (or forward secrecy) but also post-quantum authentication. To achieve this, we replace the Diffie-Hellman-based handshake by a more generic approach only using key-encapsulation mechanisms (KEMs). We establish security of PQ-WireGuard, adapting the security proofs for WireGuard in the symbolic model and in the standard model to our construction. We then instantiate this generic construction with concrete post-quantum secure KEMs, which we carefully select to achieve high security and speed. We demonstrate competitiveness of PQ-WireGuard presenting extensive bench-marking results comparing to widely deployed VPN solutions.
WireGuard is a VPN based on the Noise protocol, known for its high performance, small code base, and unique security features. Recently, Hülsing et al. (IEEE S&P'21) presented post-quantum (PQ) WireGuard, replacing the Diffie-Hellman (DH) key exchange underlying the Noise protocol with key-encapsulation mechanisms (KEMs). Since WireGuard requires the handshake message to fit in one UDP packet of size roughly 1200 B, they combined Classic McEliece and a modified variant of Saber. However, as Classic McEliece public keys are notoriously large, this comes at the cost of severely increasing the server's memory requirement. This hinders deployment, especially in environments with constraints on memory (allocation), such as a kernel-level implementations.In this work, we revisit PQ WireGuard and improve it on three fronts: design, (computational) security, and efficiency. As KEMs are semantically, but not syntactically, the same as DH key exchange, there are many (in hindsight) ad-hoc design choices being made, further amplified by the recent finding on the binding issues with PQ KEMs (Cremers et al., CCS'24). We redesign PQ WireGuard addressing these issues, and prove it secure in a new computational model by fixing and capturing new security features that were not modeled by Hülsing et al. We further propose 'reinforced KEM' (RKEM) as a natural building block for key exchange protocols, enabling a PQ WireGuard construction where the server no longer needs to store Classical McEliece keys, reducing public key memory by 190 to 390×. In essence, we construct a RKEM named 'Rebar' to compress two ML-KEM-like ciphertexts which may be of an independent interest.
This paper presents a user-space integration of ML-KEM-768, a post-quantum key encapsulation mechanism, with WireGuard, a modern VPN protocol. Rather than modifying the Diffie-Hellman handshake of the X25519 elliptic curve at kernel level, the proposed approach establishes a Kyber-based shared secret over the sockets. It injects it as a Pre-Shared Key (PSK) into WireGuard’s Noise protocol. This enhances WireGuard’s resistance to quantum attacks without altering its core code. Experimental results demonstrate successful key agreement and acceptable performance overhead, making the solution viable for hybrid VPN deployments in the post-quantum era.
WireGuard is a widely adopted, modern, free and open-source VPN protocol known for its high performance, minimal codebase, and strong security. Like all VPN protocols relying on classical public-key cryptography, it faces a growing quantum threat in which adversaries are already collecting encrypted traffic today, intending to decrypt it once sufficiently powerful quantum computers become available, a strategy known as “harvest now, decrypt later”. This thesis evaluates the integration of two NIST-selected post-quantum Key Encapsulation Mechanisms (KEMs): ML-KEM and Hamming Quasi-Cyclic (HQC) into WireGuard’s handshake protocol. Both hybrid and pure-KEM handshake variants were designed and implemented in wireguard-go, the official userspace Go implementation of WireGuard, and benchmarked across handshake latency, message size, and per-peer storage requirements. Results show that ML-KEM integrates well as the hybrid ML-KEM768 variant fits within a single IPv4 packet, adds modest overhead to handshake latency, and keeps storage requirements manageable at scale. Pure ML-KEM variants achieve full post-quantum authentication at the cost of larger messages requiring fragmentation. HQC, by contrast, produces messages large enough to force heavy fragmentation per handshake, resulting in latencies that render it incompatible with WireGuard’s design in its current form. The findings suggest that a hybrid ML-KEM-768 deployment is achievable within existing WireGuard infrastructure today, offering protection against harvest now, decrypt later attacks without replacing the current static key infrastructure or causing significant performance degradation.
WireGuard's handshake relies on a static-static Diffie-Hellman operation for which no practical post-quantum analogue exists. PQ-WireGuard addresses this limitation by restructuring the handshake around key encapsulation mechanisms (KEMs) and leveraging WireGuard's assumption that peers' static public keys are distributed out of band. This approach keeps the handshake within a single unfragmented datagram despite large post-quantum public keys while preserving initiation-message authentication. However, these assumptions break down in mesh and peer-to-peer deployments, where peers are discovered dynamically, static public keys are public by design, and the resulting default pre-shared key is computable by any observer. As a result, deployed post-quantum VPNs disable mesh networking when post-quantum mode is enabled. This paper characterizes the problem as a fundamental trade-off between KEM selection, key distribution, and wire image, and presents PQ-MESH, a post-quantum key establishment protocol for dynamically discovered peers that provides confidentiality and authentication without a coordination server. PQ-MESH carries lattice-based static public keys inline, protects responder resources using a stateless address-validation token before fragment reassembly, and binds KEM and signature keys into a single node identity. We describe the protocol, provide a reference implementation, and evaluate its wire overhead. Our evaluation shows that carrying a complete peer identity inline requires 1,312 bytes and expands the initiation flight to 7,296 bytes over seven datagrams at a 1,200-byte MTU. Despite this larger wire image, responder cost before authentication remains bounded to 54 transmitted bytes, zero allocated state, and no public-key operations, yielding an amplification factor of 0.0450. We also report a negative result: supporting mesh networking necessarily moves the handshake away from the two-datagram post-quantum QUIC Initial profile rather than toward it. This work presents a protocol design, specification, and reference implementation. It does not include a mechanized formal security proof, traffic-classification analysis, or evaluation over real network paths.
Quantum computing poses an immediate threat to VPN infrastructure through the "harvest now, decrypt later" attack model, where adversaries collect encrypted traffic today for future decryption with quantum computers. While existing VPN protocols await formal post-quantum standardization, practical protection is needed now. This paper presents a deployable solution for adding post-quantum security to WireGuard without modifying the protocol itself. Our approach leverages WireGuard's existing pre-shared key (PSK) mechanism, delivering quantum-resistant PSKs over channels protected by ML-KEM hybrid TLS 1.3. Through a carefully designed split-service architecture separating authentication from configuration management, we achieve both cryptographic and operational benefits. The authentication service handles client connections using post-quantum TLS, while the configuration service manages WireGuard settings with no direct network exposure, providing defense in depth. This architecture has been successfully deployed across ExpressVPN's global infrastructure, demonstrating its practicality at scale. The solution provides immediate quantum resistance with minimal performance impact (15-20ms additional connection establishment time, no impact on steady-state throughput), supports dynamic IP allocation and simplified key management, and can be implemented by engineering teams without deep cryptographic expertise. We provide detailed implementation guidance for deployments ranging from small (<1,000 users) to enterprise scale. Our work demonstrates that post-quantum WireGuard is achievable today using proven technologies and sound engineering principles, offering VPN providers a straightforward migration path to quantum resistance without abandoning existing WireGuard deployments.
WireGuard is a pioneering and lightweight Virtual Private Network (VPN) protocol that has been merged into the Linux kernel. It leverages the Noise secure framework to provide advanced security functionalities, such as identity hiding and perfect forward security. Although WireGuard has an optional pre-shared key mode to ensure key security, the advanced security features are guaranteed by asymmetric cryptography algorithms, which cannot be held in the face of superior quantum computers. To achieve quantum-resistant security, WireGuard should avoid using vulnerable asymmetric cryptography algorithms that are currently deeply integrated into the WireGuard protocol. In this paper, we present a solution to enhance the security of WireGuard by integrating Quantum Key Distribution (QKD). We first change the security mode to tunnel-orient Pre-Shared Keys (PSK) as the authentication anchor. We also design QKD-assisted ephemeral keys and corresponding Key Encapsulation Mechanism (KEM) to achieve WireGuard's advanced security properties without using asymmetric cryptography. We also integrate QKD keys during the key derivation to provide further security. Finally, we implement the entire protocol named WireGuard-QKD in Golang and evaluate its performance and security.