--- title: "WireGuard and quantum computers: what post-quantum protection means" description: "What a quantum computer would and wouldn't break in WireGuard, why recorded traffic is the real worry, and how the optional preshared key keeps recordings sealed." section: "Guides" group: "How the technology works" source: https://wrapvpn.com/en/guides/wireguard-and-quantum-computers last_reviewed: 2026-11-03 --- # WireGuard and quantum computers: what post-quantum protection means You've read that quantum computers will one day break today's encryption, and you'd like to know whether that includes the VPN on your phone. The short answer is partly, possibly one day, and it depends on a setting most people have never heard of. TL;DR: A large enough quantum computer could work out WireGuard's Curve25519 private keys from the public ones, which undoes the key agreement but not the cipher that seals each packet. No such machine exists, so the realistic worry is traffic recorded now and decrypted later. WireGuard's optional preshared key mixes a symmetric secret into each handshake, which keeps those recordings sealed, provided that key was itself shared safely. ## Two kinds of lock in every tunnel To see what a quantum computer would break, start with what WireGuard is made of. It uses two very different kinds of cryptography, and they fail in different ways. The first is symmetric: the same secret key locks and unlocks. WireGuard seals every packet with ChaCha20-Poly1305, which scrambles the contents and adds a tamper seal, using a 256-bit key that both ends hold. Symmetric ciphers are fast and very well studied. Their one weakness is practical: both sides need the same key before they start. The second is key agreement, which is Curve25519's job. Each side combines its own private key with the other side's public key, and both arrive at the same secret even though only public keys crossed the network. WireGuard does this at every handshake, then runs the results through BLAKE2s, a hash function, to produce the session keys that ChaCha20-Poly1305 uses. Here's our worked example. You connect to a WireGuard server from a café on a Saturday morning in 2026, and someone on the same network records every packet, handshake included, and files the recording away. Today it's useless to them. This guide is about whether it stays that way. ## What a quantum computer is actually good at A quantum computer isn't simply a faster computer. It's very good at a few particular kinds of problem, and two of them matter here. The first is Shor's algorithm, published by the mathematician Peter Shor in 1994. On a large, reliable quantum computer it efficiently solves the maths that elliptic-curve cryptography rests on. In plain words, given a Curve25519 public key, it could work out the private key. That's a clean break rather than a slowdown, and it applies to most of the public-key cryptography in use today, RSA included. The second is Grover's algorithm, which speeds up brute-force guessing of a key. The speed-up is real but modest: roughly speaking, a 256-bit key keeps the strength of a 128-bit one, which is still far beyond any attacker anyone can imagine. NIST, the US standards body, expects 256-bit AES to stay safe for a very long time, and the UK's National Cyber Security Centre says symmetric ciphers and hash functions aren't significantly affected. So the split is neat. The part of WireGuard that agrees keys is exposed. The part that seals packets, broadly speaking, isn't. ## Following the recording, step by step Fast-forward to a year when someone owns a quantum computer big enough to run Shor's algorithm against Curve25519, and give them the café recording. Here's how it comes apart. - Both handshake messages carry a one-off public key in the clear. Shor's algorithm turns each into its private key, and it does the same to the long-term public keys of your device and the server. - With every private key in hand, the attacker repeats each Curve25519 calculation the two machines made, gets the same answers and derives the same session keys. - With the session keys, every recorded packet opens. ChaCha20 was never broken; it was simply handed the right key. > **Note:** Forward secrecy doesn't help here. It keeps old traffic safe if a long-term key is stolen later, on the assumption that the one-off keys are gone for good. Against Shor's algorithm they aren't, because they can be rebuilt from the public halves sitting in the recording. ## Harvest now, decrypt later So every recorded WireGuard session is doomed, then? Not quite. But the scenario does explain why people worry about quantum computers years before one exists. The attacker can't do anything today, so their only move is to record now and wait. The strategy even has a name: harvest now, decrypt later. Live traffic in that future year can be protected by whatever cryptography is in use by then. Recordings made today are stuck with today's. WireGuard's own design paper names this exact scenario: adversaries recording encrypted traffic over the long term in the hope of breaking Curve25519 someday. How much it matters depends on what you send. Keeping huge volumes of traffic for years isn't cheap, and the NCSC reckons that makes such an attack worthwhile only for very high-value information. Your Saturday weather check is protected by sheer dullness. A journalist's source, a medical record or a company's long-term plans are another matter. ## The preshared key: a symmetric secret in the mix WireGuard's built-in answer is the optional preshared key: one random 256-bit secret that two peers both hold before they ever connect. Our guide to WireGuard keys covers how you make one and where it goes, so here we'll stick to why it matters. In the handshake, WireGuard mixes the preshared key in after the Curve25519 results, and the session keys come out of that mix. Run the café recording through the steps again. The attacker rebuilds every Curve25519 secret exactly as before, then hits a wall: the session keys also depend on 256 random bits that never appear in the handshake. Finding them means the brute-force search that Grover's algorithm barely dents. That was the plan all along. The design paper presents the preshared key as a guard against future advances in quantum computing, and WireGuard's list of known limitations says it can add a layer of post-quantum secrecy. It's a hybrid in the useful sense: if the preshared key ever leaked, the Curve25519 protection would still be there. > **Limit:** A preshared key only helps if it was shared safely. If it was sent over a connection protected by today's public-key cryptography and someone recorded that too, the attacker breaks that recording first and collects the key on the way. It also doesn't hide which device connected: your device's long-term public key travels in the first handshake message, sealed before the preshared key joins in. ## Real post-quantum key exchange, layered on top A fixed preshared key has a weakness of its own: it's a long-lived secret that somebody has to hand out, and the design paper's idea is that it should be long forgotten by the time Curve25519 falls. The fuller answer is a post-quantum key exchange, built on maths that no known quantum algorithm can shortcut. NIST published its first standard for one, ML-KEM, in August 2024. WireGuard hasn't swapped Curve25519 out, and there's a reason for that. It has one fixed set of cryptography with nothing to negotiate, so replacing a part means a new version of the protocol rather than a new option. Its documentation still says it isn't post-quantum secure by default, and points to the route people take instead: run a proper post-quantum handshake on top of WireGuard and feed the key it produces into the preshared key slot. That's exactly what Rosenpass does. It's an open-source project designed to work alongside WireGuard: it runs a key exchange built on the post-quantum algorithms Classic McEliece and Kyber, and hands WireGuard a fresh preshared key every two minutes. WireGuard still does its usual Curve25519 handshake underneath, so the pair is no weaker than WireGuard alone. ## So when should you worry? Nobody knows when, or whether, a quantum computer able to break Curve25519 will exist. None does today: current machines are small and make too many errors. The NCSC says the timing is hard to predict because many engineering and physical problems remain, while NIST notes that some experts expect one within a decade. That uncertainty is the whole case for acting early. If the machine never arrives, a preshared key cost very little. If it does, only the protection in place on the day the traffic was recorded will count. ## Where WrapVPN stands WrapVPN is built on standard WireGuard, with the Curve25519 key agreement and ChaCha20-Poly1305 sealing described above. Our configurations do include a preshared key, so every handshake mixes a symmetric secret in with the Curve25519 maths, and there's nothing for you to set up. We don't call that quantum-proof, though. Like any preshared key, ours has to be shared between the app and our servers, and that happens over an ordinary encrypted internet connection, so its protection against a future quantum computer is only as strong as that connection's. Against every computer that exists today, standard WireGuard is more than enough. If you'd like to see it in action, install WrapVPN and connect on the free plan, which gives you three one-hour sessions a week. ## Questions ### Is WireGuard quantum-safe? Not by default. A large enough quantum computer could break Curve25519, the key agreement in every WireGuard handshake, and so decrypt traffic recorded today. Adding a preshared key, or a post-quantum key exchange that supplies one, closes that gap for the traffic itself, provided the key was shared safely. ### Does a preshared key make WireGuard post-quantum? It adds a layer of post-quantum protection, which is why WireGuard's designers included it. Recorded traffic stays sealed even if Curve25519 falls, as long as the preshared key itself was shared in a way a quantum computer can't undo. It doesn't hide which device keys took part in the handshake. ### Can a quantum computer break ChaCha20? Not in any practical sense, as far as anyone knows. The best-known quantum attack on a symmetric cipher, Grover's algorithm, only speeds up guessing the key, and a 256-bit key still leaves an enormous search. The weak point is how the key was agreed, not the cipher that uses it. ### What does harvest now, decrypt later mean? It's the strategy of recording encrypted traffic today and storing it until a future computer can break the key agreement that protected it. Nothing can be read at the time, which makes it easy to dismiss. It matters most for information that will still be sensitive years from now. ### Does WrapVPN use a WireGuard preshared key? Yes. Our configurations include one, so each handshake mixes a symmetric secret in with the Curve25519 maths. We don't describe WrapVPN as quantum-proof, because that key is shared over an ordinary encrypted connection, but it does mean a recording of the tunnel alone isn't enough, and there's nothing to switch on. --- Source: https://wrapvpn.com/en/guides/wireguard-and-quantum-computers Last reviewed: 2026-11-03