Fwd: [security-lunch] Aug 19 | Guilhem Niot on "Migrating Protocols to the Post-Quantum Setting: The Case of WireGuard"

[Alan Karp]

--------------
Alan Karp

---------- Forwarded message ---------
From: Michael Leo Paper via security-lunch <securit...@lists.stanford.edu>
Date: Mon, Aug 17, 2026 at 10:17 AM
Subject: [security-lunch] Aug 19 | Guilhem Niot on "Migrating Protocols to the Post-Quantum Setting: The Case of WireGuard"
To: securit...@lists.stanford.edu <securit...@lists.stanford.edu>

Security Lunch ☀️ Ed. — Wednesday,  August 19th, 2026, 12:00 pm @ CoDa E160

Migrating Protocols to the Post-Quantum Setting: The Case of WireGuard

Guilhem Niot

Can't make it in person? Join us on zoom.

See our past & upcoming events on our website! 

Abstract: 

WireGuard owes its success to ruthless simplicity: a single Diffie-Hellman (DH) handshake that fits in one UDP packet, and has a simple state machine, which allow WireGuard to live comfortably in the Linux kernel. Post-quantum migration breaks that simplicity in two ways. First, there's no drop-in post-quantum replacement for Diffie-Hellman. A KEM's encapsulate and decapsulate are asymmetric in ways DH is not, and the original post-quantum WireGuard design by Hülsing et al. (S&P '21) introduced an unknown key-share attack due to that asymmetry. Second, the KEM Hülsing et al. use, Classic McEliece, which is crucial to have compact ciphertexts fitting within UDP and avoid the state machine complexity that would come with packet fragmentation, has public keys around 260 KB, turning per-client server memory into a resource-exhaustion vector. This is further exacerbated by the kernel integration of WireGuard. I'll cover both problems and our fixes: a redesigned handshake that closes the attack, and a new primitive, reinforced KEMs, with a concrete instantiation called Rebar that replaces Classic McEliece to cut server-side key memory by 190 to 390 times and staying within WireGuard's UDP constraint.

Bio:

I'm Guilhem Niot, a researcher at PQShield, and recent PhD graduate from Université of Rennes and PQShield. I am working on post-quantum cryptography. My research includes lattice-based threshold signatures, and the migration of real-world protocols, such as Signal and WireGuard, to post-quantum security.

_______________________________________________
security-lunch mailing list
securit...@lists.stanford.edu
https://mailman.stanford.edu/mailman/listinfo/security-lunch