[GH-ISSUE #2853] Post-quantum key exchange for AmneziaWG (Rosenpass-style rotating PSKs), especially on mobile #1297

New issue

Open

opened 2026-10-13 20:39:45 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-13 20:39:45 +00:00

Owner

Originally created by @planetryan on GitHub (Jul 20, 2026).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2853

AmneziaWG inherits WireGuard's Noise_IK handshake, which uses X25519. That is
not post-quantum secure. For users whose threat model includes harvest now,
decrypt later (HNDL), this matters: traffic recorded today can be decrypted
later by an adversary with a cryptographically relevant quantum computer.

WireGuard's existing answer is the preshared key (PSK), which is mixed into the
handshake and leaves an attacker facing a 256-bit symmetric secret. That works,
and AmneziaWG inherits it. But the PSK is static: it lives in a config file
indefinitely, so a single exfiltration retroactively exposes every recorded
session.

Rosenpass solves exactly this for WireGuard. It runs
alongside the tunnel, performs a post-quantum key exchange (Classic McEliece +
Kyber), and continuously rotates WireGuard's PSK (roughly every two minutes).
It does not carry data and does not modify WireGuard, so the composition is
strictly no weaker than WireGuard alone.

The gap this proposal addresses

Rosenpass is a desktop and server tool. There is no mobile implementation,
and mobile is where AmneziaWG has the most users.

This produces an asymmetry that users cannot resolve themselves: a Linux peer
can have post-quantum protection, while the phone on the same tunnel cannot.
For a typical AmneziaWG user whose primary (often only) client is Android or
iOS, post-quantum protection is currently unreachable no matter how the server
is configured.

Amnezia is unusually well placed here, because unlike Rosenpass upstream you
already ship and maintain first-party Android and iOS clients.

Concrete requests, smallest first

I have deliberately ordered these so that the cheapest one is independently
useful even if the larger ones are rejected.

Confirm/document that external PSK rotation works via awg.
Rosenpass applies keys through the wg tool. AmneziaWG ships awg. If
awg set <iface> peer <pubkey> preshared-key <file> is a supported and
stable interface, third-party tools like Rosenpass can drive AmneziaWG
today with only a small shim, and a line in the docs saying so would
unblock desktop users immediately.
Do not let obfuscation parameters interfere with PSK rotation.
A brief statement (or test) that rotating the PSK does not disturb the
Jc/Jmin/Jmax/S1/S2/H1-H4 machinery would give integrators confidence.
Post-quantum support in the mobile clients.
This is the actual ask. Either an embedded Rosenpass-style handshake, or a
mechanism allowing an external component to supply rotating PSKs to the
tunnel. This is the only one of the three that closes the gap for the
majority of AmneziaWG users.

Why this fits AmneziaWG specifically

AmneziaWG exists because its users have adversaries who inspect traffic. That
population overlaps heavily with the population whose traffic is worth
recording and storing. Obfuscation defends against identification today;
post-quantum key exchange defends against decryption tomorrow. They are
complementary, and a project that has already invested in the first has a
coherent reason to care about the second.

Prior art / references

Rosenpass: https://rosenpass.eu/ Rust, liboqs, requires running on
both peers
NetBird documents Rosenpass integration and explicitly notes it is not
supported on mobile:
https://docs.netbird.io/client/post-quantum-cryptography
OPNsense discussion of adding Rosenpass to WireGuard:
https://github.com/opnsense/core/issues/7946

Why not upstream WireGuard

Filing this against WireGuard itself would very likely be declined, and it is
worth saying why rather than wasting maintainer time:

WireGuard's position is that the PSK is the post-quantum story. It was
designed into the protocol for precisely this reason, and the project's
preferred path for stronger guarantees is an external component such as
Rosenpass rather than changing the handshake. WireGuard also does not use
GitHub issues; it uses a mailing list. So the actionable venue is AmneziaWG,
where the mobile gap actually lives and where first-party mobile clients exist.

Originally created by @planetryan on GitHub (Jul 20, 2026). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/2853 AmneziaWG inherits WireGuard's Noise_IK handshake, which uses X25519. That is not post-quantum secure. For users whose threat model includes *harvest now, decrypt later* (HNDL), this matters: traffic recorded today can be decrypted later by an adversary with a cryptographically relevant quantum computer. WireGuard's existing answer is the preshared key (PSK), which is mixed into the handshake and leaves an attacker facing a 256-bit symmetric secret. That works, and AmneziaWG inherits it. But the PSK is **static**: it lives in a config file indefinitely, so a single exfiltration retroactively exposes every recorded session. [Rosenpass](https://rosenpass.eu/) solves exactly this for WireGuard. It runs alongside the tunnel, performs a post-quantum key exchange (Classic McEliece + Kyber), and continuously rotates WireGuard's PSK (roughly every two minutes). It does not carry data and does not modify WireGuard, so the composition is strictly no weaker than WireGuard alone. ### The gap this proposal addresses Rosenpass is a desktop and server tool. **There is no mobile implementation**, and mobile is where AmneziaWG has the most users. This produces an asymmetry that users cannot resolve themselves: a Linux peer can have post-quantum protection, while the phone on the same tunnel cannot. For a typical AmneziaWG user whose primary (often only) client is Android or iOS, post-quantum protection is currently unreachable no matter how the server is configured. Amnezia is unusually well placed here, because unlike Rosenpass upstream you already ship and maintain first-party Android and iOS clients. ### Concrete requests, smallest first I have deliberately ordered these so that the cheapest one is independently useful even if the larger ones are rejected. 1. **Confirm/document that external PSK rotation works via `awg`.** Rosenpass applies keys through the `wg` tool. AmneziaWG ships `awg`. If `awg set <iface> peer <pubkey> preshared-key <file>` is a supported and stable interface, third-party tools like Rosenpass can drive AmneziaWG today with only a small shim, and a line in the docs saying so would unblock desktop users immediately. 2. **Do not let obfuscation parameters interfere with PSK rotation.** A brief statement (or test) that rotating the PSK does not disturb the Jc/Jmin/Jmax/S1/S2/H1-H4 machinery would give integrators confidence. 3. **Post-quantum support in the mobile clients.** This is the actual ask. Either an embedded Rosenpass-style handshake, or a mechanism allowing an external component to supply rotating PSKs to the tunnel. This is the only one of the three that closes the gap for the majority of AmneziaWG users. ### Why this fits AmneziaWG specifically AmneziaWG exists because its users have adversaries who inspect traffic. That population overlaps heavily with the population whose traffic is worth recording and storing. Obfuscation defends against *identification* today; post-quantum key exchange defends against *decryption* tomorrow. They are complementary, and a project that has already invested in the first has a coherent reason to care about the second. ### Prior art / references - Rosenpass: https://rosenpass.eu/ Rust, liboqs, requires running on both peers - NetBird documents Rosenpass integration and explicitly notes it is not supported on mobile: https://docs.netbird.io/client/post-quantum-cryptography - OPNsense discussion of adding Rosenpass to WireGuard: https://github.com/opnsense/core/issues/7946 ### Why not upstream WireGuard Filing this against WireGuard itself would very likely be declined, and it is worth saying why rather than wasting maintainer time: WireGuard's position is that the PSK **is** the post-quantum story. It was designed into the protocol for precisely this reason, and the project's preferred path for stronger guarantees is an external component such as Rosenpass rather than changing the handshake. WireGuard also does not use GitHub issues; it uses a mailing list. So the actionable venue is AmneziaWG, where the mobile gap actually lives and where first-party mobile clients exist.

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#1297

No description provided.

Rows
Columns