PQ-WireGuard

WireGuard is a VPN protocol that runs over UDP and follows the Noise framework's "IK" pattern, using Diffie–Hellman for key exchange. WireGuard's design constraints are tight: each handshake message must fit in one UDP packet (~1232 B for IPv6), and the kernel-level implementation has a small memory budget per peer.

Hülsing et al. (IEEE S&P 2021) proposed PQ-WireGuard, replacing the DH key exchange with KEMs:

• Long-term: Classic McEliece (very small ciphertexts, very large public keys ~261 kB)
• Ephemeral: a modified IND-CPA Saber

Wire-size constraint satisfied; server memory now holds ~261 kB per client long-term key. Acceptable for some deployments, blocker for kernel-level use.

Two 2025–2026 papers, concurrent and independent, revisit PQ-WireGuard:

pq-wireguard-revisited (Hashimoto, Katsumata, Niot, Wiggers — IACR 2025/1758, AIST + PQShield):

• Introduces reinforcing KEMs (RKEM) as a clean abstraction
• Builds Rebar, a lattice RKEM with ~40% smaller ciphertext than two ML-KEMs
• Reduces server long-term PK memory by 190–390× (down to ~1.4 kB)
• Streamlines the key schedule, removes duplicated PSK absorption
• Extends the computational security model to match the symbolic one; fixes a subtle PSK-handling bug in the prior model
• Identifies a UKS attack via KEM binding when instantiated with general KEMs

hybrid-wireguard (Lafourcade, Mahmoud, Ruhault, Taleb — USENIX Security 2025, UCA + ANSSI):

• Formal analysis of PQ-WireGuard in SAPIC+ (compiles to ProVerif, Tamarin, DeepSec)
• Independently identifies the same UKS attack
• Proposes PQ-WireGuard⋆ (fixes via concatenating static PKs to PSK in H4)
• Designs Hybrid-WireGuard combining classical WireGuard with PQ-WireGuard⋆ — secure if either piece is secure
• Provides a Rust implementation with benchmarks
• Adaptive evaluation strategy to make formal analysis tractable

The two are complementary: Hashimoto et al. wins on engineering (deployable kernel-level memory budget), Lafourcade et al. wins on formal coverage and gives a usable Rust hybrid implementation now.

Adjacent existing PQ approaches:

• Rosenpass — runs PQ-WireGuard as a side-car protocol, injects results as PSKs into classical WireGuard. Conservative, more overhead, still uses Classic McEliece.
• NordLynx — does PQ key exchange inside the established WireGuard tunnel (passive-only PQ security)
• Commercial "PQ" WireGuard offerings — typically PSK-only with out-of-band PQ key delivery, details vary

Connects to the broader crqc-timeline story: April 2026 papers compressed the CRQC threat horizon, store-now-decrypt-later makes PQ migration urgent today, and VPN protocols (long sessions, identity material) are first-priority targets.