WireGuard's handshake relies on a static-static Diffie-Hellman operation for which no practical post-quantum analogue exists. PQ-WireGuard addresses this limitation by restructuring the handshake around key encapsulation mechanisms (KEMs) and leveraging WireGuard's assumption that peers' static public keys are distributed out of band. This approach keeps the handshake within a single unfragmented datagram despite large post-quantum public keys while preserving initiation-message authentication. However, these assumptions break down in mesh and peer-to-peer deployments, where peers are discovered dynamically, static public keys are public by design, and the resulting default pre-shared key is computable by any observer. As a result, deployed post-quantum VPNs disable mesh networking when post-quantum mode is enabled. This paper characterizes the problem as a fundamental trade-off between KEM selection, key distribution, and wire image, and presents PQ-MESH, a post-quantum key establishment protocol for dynamically discovered peers that provides confidentiality and authentication without a coordination server. PQ-MESH carries lattice-based static public keys inline, protects responder resources using a stateless address-validation token before fragment reassembly, and binds KEM and signature keys into a single node identity. We describe the protocol, provide a reference implementation, and evaluate its wire overhead. Our evaluation shows that carrying a complete peer identity inline requires 1,312 bytes and expands the initiation flight to 7,296 bytes over seven datagrams at a 1,200-byte MTU. Despite this larger wire image, responder cost before authentication remains bounded to 54 transmitted bytes, zero allocated state, and no public-key operations, yielding an amplification factor of 0.0450. We also report a negative result: supporting mesh networking necessarily moves the handshake away from the two-datagram post-quantum QUIC Initial profile rather than toward it. This work presents a protocol design, specification, and reference implementation. It does not include a mechanized formal security proof, traffic-classification analysis, or evaluation over real network paths.
WireGuard's handshake relies on a static-static Diffie-Hellman operation for which no practical post-quantum analogue exists. PQ-WireGuard addresses this limitation by restructuring the handshake around key encapsulation mechanisms (KEMs) and leveraging WireGuard's assumption that peers' static public keys are distributed out of band. This approach keeps the handshake within a single unfragmented datagram despite large post-quantum public keys while preserving initiation-message authentication. However, these assumptions break down in mesh and peer-to-peer deployments, where peers are discovered dynamically, static public keys are public by design, and the resulting default pre-shared key is computable by any observer. As a result, deployed post-quantum VPNs disable mesh networking when post-quantum mode is enabled. This paper characterizes the problem as a fundamental trade-off between KEM selection, key distribution, and wire image, and presents PQ-MESH, a post-quantum key establishment protocol for dynamically discovered peers that provides confidentiality and authentication without a coordination server. PQ-MESH carries lattice-based static public keys inline, protects responder resources using a stateless address-validation token before fragment reassembly, and binds KEM and signature keys into a single node identity. We describe the protocol, provide a reference implementation, and evaluate its wire overhead. Our evaluation shows that carrying a complete peer identity inline requires 1,312 bytes and expands the initiation flight to 7,296 bytes over seven datagrams at a 1,200-byte MTU. Despite this larger wire image, responder cost before authentication remains bounded to 54 transmitted bytes, zero allocated state, and no public-key operations, yielding an amplification factor of 0.0450. We also report a negative result: supporting mesh networking necessarily moves the handshake away from the two-datagram post-quantum QUIC Initial profile rather than toward it. This work presents a protocol design, specification, and reference implementation. It does not include a mechanized formal security proof, traffic-classification analysis, or evaluation over real network paths.
In this paper we present PQ-WireGuard, a post-quantum variant of the handshake in the WireGuard VPN protocol (NDSS 2017). Unlike most previous work on post-quantum security for real-world protocols, this variant does not only consider post-quantum confidentiality (or forward secrecy) but also post-quantum authentication. To achieve this, we replace the Diffie-Hellman-based handshake by a more generic approach only using key-encapsulation mechanisms (KEMs). We establish security of PQ-WireGuard, adapting the security proofs for WireGuard in the symbolic model and in the standard model to our construction. We then instantiate this generic construction with concrete post-quantum secure KEMs, which we carefully select to achieve high security and speed. We demonstrate competitiveness of PQ-WireGuard presenting extensive bench-marking results comparing to widely deployed VPN solutions.
WireGuard is a VPN based on the Noise protocol, known for its high performance, small code base, and unique security features. Recently, Hülsing et al. (IEEE S&P'21) presented post-quantum (PQ) WireGuard, replacing the Diffie-Hellman (DH) key exchange underlying the Noise protocol with key-encapsulation mechanisms (KEMs). Since WireGuard requires the handshake message to fit in one UDP packet of size roughly 1200 B, they combined Classic McEliece and a modified variant of Saber. However, as Classic McEliece public keys are notoriously large, this comes at the cost of severely increasing the server's memory requirement. This hinders deployment, especially in environments with constraints on memory (allocation), such as a kernel-level implementations.In this work, we revisit PQ WireGuard and improve it on three fronts: design, (computational) security, and efficiency. As KEMs are semantically, but not syntactically, the same as DH key exchange, there are many (in hindsight) ad-hoc design choices being made, further amplified by the recent finding on the binding issues with PQ KEMs (Cremers et al., CCS'24). We redesign PQ WireGuard addressing these issues, and prove it secure in a new computational model by fixing and capturing new security features that were not modeled by Hülsing et al. We further propose 'reinforced KEM' (RKEM) as a natural building block for key exchange protocols, enabling a PQ WireGuard construction where the server no longer needs to store Classical McEliece keys, reducing public key memory by 190 to 390×. In essence, we construct a RKEM named 'Rebar' to compress two ML-KEM-like ciphertexts which may be of an independent interest.
WireGuard is a widely adopted, modern, free and open-source VPN protocol known for its high performance, minimal codebase, and strong security. Like all VPN protocols relying on classical public-key cryptography, it faces a growing quantum threat in which adversaries are already collecting encrypted traffic today, intending to decrypt it once sufficiently powerful quantum computers become available, a strategy known as “harvest now, decrypt later”. This thesis evaluates the integration of two NIST-selected post-quantum Key Encapsulation Mechanisms (KEMs): ML-KEM and Hamming Quasi-Cyclic (HQC) into WireGuard’s handshake protocol. Both hybrid and pure-KEM handshake variants were designed and implemented in wireguard-go, the official userspace Go implementation of WireGuard, and benchmarked across handshake latency, message size, and per-peer storage requirements. Results show that ML-KEM integrates well as the hybrid ML-KEM768 variant fits within a single IPv4 packet, adds modest overhead to handshake latency, and keeps storage requirements manageable at scale. Pure ML-KEM variants achieve full post-quantum authentication at the cost of larger messages requiring fragmentation. HQC, by contrast, produces messages large enough to force heavy fragmentation per handshake, resulting in latencies that render it incompatible with WireGuard’s design in its current form. The findings suggest that a hybrid ML-KEM-768 deployment is achievable within existing WireGuard infrastructure today, offering protection against harvest now, decrypt later attacks without replacing the current static key infrastructure or causing significant performance degradation.
This paper presents a user-space integration of ML-KEM-768, a post-quantum key encapsulation mechanism, with WireGuard, a modern VPN protocol. Rather than modifying the Diffie-Hellman handshake of the X25519 elliptic curve at kernel level, the proposed approach establishes a Kyber-based shared secret over the sockets. It injects it as a Pre-Shared Key (PSK) into WireGuard’s Noise protocol. This enhances WireGuard’s resistance to quantum attacks without altering its core code. Experimental results demonstrate successful key agreement and acceptable performance overhead, making the solution viable for hybrid VPN deployments in the post-quantum era.
Quantum computing poses an immediate threat to VPN infrastructure through the "harvest now, decrypt later" attack model, where adversaries collect encrypted traffic today for future decryption with quantum computers. While existing VPN protocols await formal post-quantum standardization, practical protection is needed now. This paper presents a deployable solution for adding post-quantum security to WireGuard without modifying the protocol itself. Our approach leverages WireGuard's existing pre-shared key (PSK) mechanism, delivering quantum-resistant PSKs over channels protected by ML-KEM hybrid TLS 1.3. Through a carefully designed split-service architecture separating authentication from configuration management, we achieve both cryptographic and operational benefits. The authentication service handles client connections using post-quantum TLS, while the configuration service manages WireGuard settings with no direct network exposure, providing defense in depth. This architecture has been successfully deployed across ExpressVPN's global infrastructure, demonstrating its practicality at scale. The solution provides immediate quantum resistance with minimal performance impact (15-20ms additional connection establishment time, no impact on steady-state throughput), supports dynamic IP allocation and simplified key management, and can be implemented by engineering teams without deep cryptographic expertise. We provide detailed implementation guidance for deployments ranging from small (<1,000 users) to enterprise scale. Our work demonstrates that post-quantum WireGuard is achievable today using proven technologies and sound engineering principles, offering VPN providers a straightforward migration path to quantum resistance without abandoning existing WireGuard deployments.
Quantum computing threatens current public-key cryptography. New quantum-safe communication protocols are needed to address this threat. PQConnect is a tunnelling protocol designed for automated, end-to-end secure communication that resists quantum attacks while remaining compatible with existing infrastructure. It employs a hybrid handshake integrating classical and post-quantum primitives to establish shared keys. This thesis analyses PQConnect’s handshake, which uses a nested hybrid key exchange combining three schemes. It layers Classic McEliece (a code-based key encapsulation), X25519 (Curve25519 elliptic-curve Diffie–Hellman), and SNTRUP761 (Streamlined NTRU Prime) key encapsulations. These are being utilized as Key Encapsulation Mechanisms (KEMs). The layers are nested so that each inner exchange is concealed by outer layers, making any single layer difficult to break. The analysis details how each layer contributes to key establishment and how fresh ephemeral keys ensure forward secrecy. Additional PQConnect mechanisms are examined, including streaming verification of hand-shake data and DNS-based key distribution. Streaming verification processes large hand-shake records incrementally, reducing memory usage. For key distribution, PQConnect retrieves hashed server public keys via authenticated DNS records: a client fetches a hash of the server’s long-term key from DNS and verifies it before initiating the handshake, avoiding reliance on centralized certificates. A ratcheting key schedule derives new chain keys for each time epoch and per-packet encryption keys, limiting key exposure and extending forward secrecy beyond the initial handshake. For performance evaluation, packet-level traffic was captured using Wireshark for both PQConnect and traditional TLS sessions. Captured packets were analyzed to compare handshake flows and performance metrics such as packet size and total transmitted data. The results show that PQConnect introduces only a modest increase in packet sizes and overall data volume, with no significant latency overhead. Streaming verification and DNS-based lookup were confirmed to function correctly without noticeable delay. In conclusion, the study finds that PQConnect can establish quantum-secure tunnels with minimal performance penalty. Its hybrid handshake effectively integrates post-quantum primitives while maintaining compatibility with current infrastructure. DNS-based key distribution and streaming verification enhance trust and efficiency. The ratchet mechanism provides robust forward secrecy. These findings suggest that PQConnect is a practical and future-ready solution for secure tunnelling.