WireGuard is one of the newer VPN protocols. Its development and adoption accelerated significantly in the late 2010s. A major milestone came on January 29, 2020, when WireGuard was merged into the Linux kernel's mainline development tree. Support for WireGuard subsequently appeared in major platforms and operating systems, including Debian, Windows, and Android. The first stable release, version 1.0.0, was published on March 29, 2020.
Technical Characteristics of WireGuard
WireGuard uses a modern, fixed set of cryptographic primitives:
- Curve25519 for public-key cryptography and key agreement;
- ChaCha20 for symmetric encryption;
- Poly1305 for message authentication;
- SipHash for hash-table key handling;
- BLAKE2s for hashing;
- HKDF for key derivation.
WireGuard transports VPN traffic over UDP.
The protocol is open source.
Advantages of WireGuard
Compared with older VPN technologies such as IPsec and OpenVPN, WireGuard has several significant advantages. Its codebase is deliberately compact and designed around a small set of modern cryptographic primitives. The implementation in the Linux kernel consists of only a few thousand lines of code, making it considerably smaller and easier to audit than many traditional VPN implementations.
The streamlined design reduces the amount of code that needs to be maintained and audited, which can help minimize the potential attack surface. Its low overhead also makes WireGuard well suited to a wide range of hardware, from smartphones and home routers to high-performance network equipment.
WireGuard's security model is based on a deliberately limited set of modern cryptographic algorithms rather than the large collection of configurable cipher suites found in some older VPN protocols. Once a connection is established, WireGuard uses a built-in mechanism for periodically updating its session keys. This provides forward secrecy and limits the amount of traffic protected by any individual session key.
Disadvantages of WireGuard
One potential disadvantage is that WireGuard is considerably newer than established VPN technologies such as IPsec and OpenVPN, although it is now supported by a wide range of operating systems, devices, and VPN services.
Another limitation is its use of UDP as the transport protocol. Some networks and firewalls restrict or block UDP traffic, which can prevent a WireGuard connection from being established or make it less suitable for certain restrictive network environments.