WireGuard: ChaCha20 and Curve25519 VPN

WireGuard was designed with radical simplicity as a primary goal. Its codebase is approximately 4,000 lines, compared to 70,000 for OpenVPN and over 400,000 for strongSwan IPsec. Fewer lines mean fewer potential vulnerabilities and an audit surface small enough for a single engineer to review thoroughly. This simplicity is a deliberate security choice, not a feature limitation.

Unlike OpenVPN and IPsec, WireGuard does not negotiate cryptographic algorithms. Every WireGuard connection uses the same fixed set of primitives: Curve25519 for ECDH, ChaCha20-Poly1305 for authenticated encryption, BLAKE2s for hashing, and SipHash-2-4 for hashtable security. This eliminates cipher negotiation, which removes an entire class of downgrade attacks.