WireGuard: ChaCha20 and Curve25519 VPN

WireGuard was designed with radical simplicity as a primary goal. Its codebase is approximately 4,000 lines, compared to 70,000 for OpenVPN and over 400,000 for strongSwan IPsec. Fewer lines mean fewer potential vulnerabilities and an audit surface small enough for a single engineer to review thoroughly. This simplicity is a deliberate security choice, not a feature limitation.

Unlike OpenVPN and IPsec, WireGuard does not negotiate cryptographic algorithms. Every WireGuard connection uses the same fixed set of primitives: Curve25519 for ECDH, ChaCha20-Poly1305 for authenticated encryption, BLAKE2s for hashing, and SipHash-2-4 for hashtable security. This eliminates cipher negotiation, which removes an entire class of downgrade attacks.

WireGuard implements the Noise_IKpsk2 handshake pattern from the Noise Protocol Framework. This framework provides a principled way to build key exchange protocols with provable security properties. The IKpsk2 pattern uses static and ephemeral key pairs with an optional pre-shared key for additional quantum resistance, completing the handshake in a single round trip.

Curve25519 is an elliptic curve designed by Daniel Bernstein for high performance and security. WireGuard uses it for Elliptic Curve Diffie-Hellman (ECDH) key agreement. Each peer has a static Curve25519 key pair for long-term identity, and the handshake also uses ephemeral key pairs to provide forward secrecy. Curve25519 operations are constant-time, resisting timing attacks.

WireGuard encrypts all data packets with ChaCha20-Poly1305, an authenticated encryption algorithm. ChaCha20 is a stream cipher that is extremely fast on devices without AES hardware acceleration (smartphones, embedded devices). Poly1305 provides the authentication tag. The combined AEAD construction ensures that any tampering with the ciphertext is detected before decryption.

BLAKE2s is a cryptographic hash function optimized for 32-bit platforms and short messages. WireGuard uses it in the key derivation steps of the handshake and for session identifier computation. BLAKE2s is faster than SHA-256 on most platforms while providing equivalent security. It was designed as a successor to SHA-3 finalist BLAKE.

WireGuard peers have a static key pair that serves as their long-term identity. Public keys are exchanged out-of-band during configuration and serve as peer identifiers. During each handshake, both peers also generate ephemeral key pairs. The ECDH between static and ephemeral keys, combined with the ECDH of ephemeral key pairs, provides both authentication and forward secrecy.

WireGuard implements cryptokey routing: each peer in the configuration specifies the IP addresses (allowed IPs) that can be reached through that peer. When an outbound packet matches a peer's allowed IPs, it is encrypted to that peer. Inbound packets are decrypted and their source IP must match the allowed IPs of the key used; otherwise they are dropped. Keys define the routing table.

WireGuard has no persistent connection concept. If no traffic is flowing, no packets are sent and the VPN effectively disappears from the network. Handshakes are triggered on demand when there is traffic to send. A configurable PersistentKeepalive setting sends periodic empty packets to maintain NAT mappings for devices behind NAT routers.

WireGuard was merged into the Linux kernel mainline in version 5.6 (released March 2020). Running in kernel space gives WireGuard direct access to the kernel networking stack and cryptographic hardware, resulting in higher throughput than user-space VPN implementations. On other platforms (Windows, macOS, iOS, Android) WireGuard runs in user space via a cross-platform implementation.

Benchmarks consistently show WireGuard outperforming OpenVPN by 3-4x in throughput. IPsec with AES-NI hardware acceleration is competitive with WireGuard on systems with AES hardware. On ARM devices without AES-NI, WireGuard's ChaCha20 significantly outperforms AES-based alternatives. Lower CPU usage also means better battery life on mobile devices.

Which algorithm does WireGuard use for encrypting data packets?

WireGuard recap: ~4,000 lines of code for minimal attack surface, fixed primitives (no negotiation), Noise IKpsk2 handshake with Curve25519, ChaCha20-Poly1305 for data, BLAKE2s for hashing, cryptokey routing ties IP ranges to public keys, ephemeral keys provide forward secrecy, kernel integration for maximum performance, and stateless connection model with on-demand handshakes.