# PQ-WireGuard

WireGuard is a VPN protocol that runs over UDP and follows the Noise framework's "IK" pattern, using Diffie–Hellman for key exchange. WireGuard's design constraints are tight: each handshake message must fit in one UDP packet (~1232 B for IPv6), and the kernel-level implementation has a small memory budget per peer.

Hülsing et al. (IEEE S&P 2021) proposed **PQ-WireGuard**, replacing the DH key exchange with KEMs:
- **Long-term**: Classic McEliece (very small ciphertexts, very large public keys ~261 kB)
- **Ephemeral**: a modified IND-CPA Saber

Wire-size constraint satisfied; *server memory* now holds ~261 kB per client long-term key. Acceptable for some deployments, blocker for kernel-level use.

Two 2025–2026 papers, concurrent and independent, revisit PQ-WireGuard:

**[[pq-wireguard-revisited]]** (Hashimoto, Katsumata, Niot, Wiggers — IACR 2025/1758, AIST + PQShield):
- Introduces **reinforcing KEMs (RKEM)** as a clean abstraction
- Builds **Rebar**, a lattice RKEM with ~40% smaller ciphertext than two ML-KEMs
- Reduces server long-term PK memory by 190–390× (down to ~1.4 kB)
- Streamlines the key schedule, removes duplicated PSK absorption
- Extends the computational security model to match the symbolic one; fixes a subtle PSK-handling bug in the prior model
- Identifies a UKS attack via KEM binding when instantiated with general KEMs

**[[hybrid-wireguard]]** (Lafourcade, Mahmoud, Ruhault, Taleb — USENIX Security 2025, UCA + ANSSI):
- Formal analysis of PQ-WireGuard in **SAPIC+** (compiles to ProVerif, Tamarin, DeepSec)
- Independently identifies the same UKS attack
- Proposes **PQ-WireGuard⋆** (fixes via concatenating static PKs to PSK in `H4`)
- Designs **Hybrid-WireGuard** combining classical WireGuard with PQ-WireGuard⋆ — secure if either piece is secure
- Provides a Rust implementation with benchmarks
- Adaptive evaluation strategy to make formal analysis tractable

The two are complementary: Hashimoto et al. wins on engineering (deployable kernel-level memory budget), Lafourcade et al. wins on formal coverage and gives a usable Rust hybrid implementation now.

Adjacent existing PQ approaches:
- **Rosenpass** — runs PQ-WireGuard as a side-car protocol, injects results as PSKs into classical WireGuard. Conservative, more overhead, still uses Classic McEliece.
- **NordLynx** — does PQ key exchange *inside* the established WireGuard tunnel (passive-only PQ security)
- **Commercial "PQ" WireGuard offerings** — typically PSK-only with out-of-band PQ key delivery, details vary

Connects to the broader [[crqc-timeline]] story: April 2026 papers compressed the CRQC threat horizon, [[store-now-decrypt-later]] makes PQ migration urgent today, and VPN protocols (long sessions, identity material) are first-priority targets.