Field Notes

entity

WireGuard

StatusStableUpdatedStands on2 sourcesSupportsnotes

WireGuard is an open VPN protocol designed by Jason Donenfeld and first released in 2016, merged into the Linux kernel in 2020 and since ported to the other major operating systems. It aims to be a faster, simpler, and more auditable replacement for IPsec and OpenVPN.

The design choices that matter for the vault’s purposes:

  • Small implementation. The reference implementation is on the order of four thousand lines of code, against hundreds of thousands for OpenVPN and IPsec stacks, which makes independent audit and formal analysis practical.
  • Fixed modern cryptography. Curve25519 for key exchange, ChaCha20 for encryption, Poly1305 for authentication, BLAKE2s for hashing. There is no cipher negotiation, so there is no downgrade path and no obsolete-algorithm configuration to get wrong.
  • Keys are identities. Peers are identified by their static public keys, and the protocol has no certificate infrastructure and no dynamic address assignment. Simplicity here is a tradeoff: key distribution and rotation are the operator’s problem.
  • Connectionless and roaming-friendly. The protocol runs over UDP and tolerates changing client IP addresses, which suits mobile devices moving between networks.

WireGuard is a transport tunnel, not an anonymity system: it encrypts between the client and the VPN server and does nothing about what the server can see, what the endpoint device leaks, or who observes the traffic’s timing and volume.

Use in this vault

  • AzireVPN hired Donenfeld in 2017, ran early WireGuard infrastructure, and has been WireGuard-only since March 2025; Penetration Test on AzireVPN covers its implementation.
  • Privacy product architecture and VPN service legal risk both recommend a mature protocol such as WireGuard over a custom tunnel protocol for any privacy service built on VPN transport.
  • The Android app’s distribution history is a documented case of a security-focused developer leaving F-Droid: in 2023 Donenfeld built an HSM-backed self-update channel and declared the direct download and the Play Store the only supported installation sources, calling the F-Droid project “basically rotted.” wireguard inclusion policy violation preserves the exchange.

Built on 2 sources (2 external).

Working out connections…