WireGuard VPN FAQs: Difference between revisions

From Edge Threat Management Wiki - Arista
Jump to navigationJump to search
mNo edit summary
No edit summary
 
(3 intermediate revisions by 2 users not shown)
Line 6: Line 6:
=== What cryptography is used in WireGuard? ===
=== What cryptography is used in WireGuard? ===


ChaCha20 for symmetric encryption, authenticated with Poly1305, using RFC7539's AEAD construction
WireGuard uses several ciphers including ChaCha20, Curve25519, BLAKE2s, SipHash24, and HKDF. For more details refer to the [https://www.wireguard.com/protocol/ WireGuard Protocol & Cryptography documentation].
Curve25519 for ECDH
 
BLAKE2s for hashing and keyed hashing, as described in RFC7693
=== What transport protocol and port does WireGuard use? ===
SipHash24 for hashtable keys
WireGuard encapsulates and encrypts all data using UDP with default port 51820. There is a built-in access rule to allow WireGuard traffic on this port.
HKDF for key derivation, as described in RFC5869
Noise_IK handshake from Noise, building on the work of CurveCP, NaCL, KEA+, SIGMA, FHMQV, and HOMQV
All packets are sent over UDP

Latest revision as of 21:47, 14 September 2023

How resilient is a WireGuard connection?

WireGuard is built for roaming. If your device changes networks, e.g. from WiFi to a mobile/cellular, the connection will persist because as long as the client sends correctly authenticated data to the WireGuard VPN server, the server keeps the connection alive.

What cryptography is used in WireGuard?

WireGuard uses several ciphers including ChaCha20, Curve25519, BLAKE2s, SipHash24, and HKDF. For more details refer to the WireGuard Protocol & Cryptography documentation.

What transport protocol and port does WireGuard use?

WireGuard encapsulates and encrypts all data using UDP with default port 51820. There is a built-in access rule to allow WireGuard traffic on this port.