What if VPNs were immune to threats from quantum computers? What if secure, high-performance, peer-to-peer connections could stand resilient even as computational power leaps forward?
Rosenpass is turning that vision into reality, enhancing today’s trusted WireGuard VPN with formally verified, post-quantum-secure key exchange, without compromising speed or simplicity.
Its relation with NGI started by getting funded through NLnet’s NGI Assure program and now NGI Search. Rosenpass is helping build a future-proof Internet infrastructure that is secure, efficient, and designed with tomorrow’s threats in mind.
The What
Rosenpass is an open-source, Rust-based add-on for WireGuard that injects post-quantum security into the key-exchange process. Rather than replacing WireGuard’s VPN logic, Rosenpass performs a post-quantum key exchange using schemes like Classic McEliece and Kyber 512 and hands the resulting symmetric key to WireGuard via its Pre-Shared Key (PSK) feature.
It is also formally verified, tested symbolically using ProVerif, and includes defenses against state-disruption attacks with cookie mechanisms.
For What
In an era where quantum computers threaten to break traditional encryption, Rosenpass steps in as a robust countermeasure. It ensures that VPN sessions, common when connecting via public Wi-Fi or remote workplaces, remain secure against “store-now, decrypt-later” attacks.
It is ideal for developers, system administrators, and security-conscious organizations looking to maintain WireGuard’s renowned performance and usability while adding quantum-grade security to their network architecture.
THE REACH
Rosenpass was launched in February 2023 and is fully open source under Apache and MIT licenses, welcoming review, testing, and contributions from both academic researchers and industry practitioners.
As part of the broader NGI Assure initiative, supported by NLnet and the European Commission’s Next Generation Internet programme and it has been presented as an Impact Story on the NGI Forum reaching thousands of itnerested attendees.
The project has expanded through related sub-projects such as Rosenpass-API, which adds API support, Windows compatibility, and broker-based architecture for granular permissions, and Rosenpass Broker, aimed at easing integration into external applications via extended Rust APIs.
THE MILESTONES
- 🔹February 2023: Public release, introducing formally verified post-quantum key exchange to WireGuard with provable security and open-source transparency.
- 🔹Symbolic Security Analysis: A large portion of NGI Assure funding supported ProVerif-based security modeling, unit testing, and documentation.
- 🔹Protocol hardening: Upgrades such as cookie-based DoS resistance, domain separation improvements, and McEliece+Kyber schemes demonstrate evolving protocol maturity.
- 🔹Broader integration and API development: Ongoing enhancements including Windows support, API/broker architecture, and TLS tutorial materials reflect a growing ecosystem.
Rosenpass began as a trusted research prototype and has evolved into a fully working, formally verified, open-source layer of post-quantum security for WireGuard. It proves that building quantum-resistant infrastructure can be practical, performant, and community-driven. As quantum threats loom, projects like Rosenpass ensure that our digital foundations remain secure and sovereign.
Publication Date
22/08/2025
OTHER PROJECTS
