Harvest-now-decrypt-later breaks that assumption. From the outside, a VPN tunnel is just a stream of encrypted packets, and anyone on the path can record it today. Once a cryptographically relevant quantum computer breaks the tunnel’s key exchange, everything inside becomes readable, including every internal protocol that relied on the tunnel for its secrecy. One key exchange protects all the traffic between two networks, which makes the VPN a prime target for anyone who records now and decrypts later.

In this third protocol deep dive, we look at WireGuard, which has become the modern default, and measure what it takes to make it quantum-safe.

Unlike TLS and SSH, WireGuard isn’t crypto-agile, and that’s on purpose. No algorithm negotiation, one fixed set of primitives. That keeps the WireGuard handshake small, but nobody can add ML-KEM to it without changing the protocol itself. Post-quantum WireGuard has to go through the one door its designers left open, an optional pre-shared key:

That 32-byte symmetric key is mixed into every handshake, and is explicitly presented as protection against future quantum attacks in WireGuard’s whitepaper. An attacker who breaks X25519 still doesn’t get the session keys without it, and if the pre-shared key leaks, the connection is as safe as plain WireGuard. Same hybrid principle as in TLS and SSH.

The catch is that a static key typed into a config file has to be distributed and rotated by hand, and it never changes on its own. The quantum-safe way is to derive a fresh one regularly, with a post-quantum key exchange running next to WireGuard.

Rosenpass combines two post-quantum key encapsulation mechanisms. Each peer has a static Classic McEliece key, and every handshake adds one ML-KEM exchange with a fresh, ephemeral key. McEliece and ML-KEM both feed into the final shared key.

Rosenpass uses McEliece for the static keys because its ciphertexts are small, 188 bytes against 768 for ML-KEM. Its public keys are huge, about 512 KB, but like WireGuard keys they’re exchanged once, out of band, and never cross the network during a handshake.

In September 2026, though, Germany’s BSI advised against Classic McEliece for new developments, after recent attacks that aren’t practical yet. Since Rosenpass also runs ML-KEM, recorded exchanges stay protected. Only authentication would be affected.

Other products follow the same McEliece + ML-KEM pattern: Mullvad VPN uses it to derive its WireGuard pre-shared key, and NetBird integrates Rosenpass directly.

Compared to our previous articles, there are only two working configurations this time. Either both peers run plain WireGuard, or both run WireGuard with Rosenpass. Rosenpass is a protocol of its own, so both ends need to switch together.

Rosenpass increases the handshake size by 2.6 KB, from 324 B to 3.0 KB. WireGuard’s own handshake stays at 324 B, so all the overhead comes from Rosenpass, mostly from ML-KEM.

Rosenpass needs two round trips, which adds 49 ms on a good network and 70 ms on degraded Wi-Fi. WireGuard’s own handshake is untouched. On Wi-Fi, it just takes longer because the network is slower.

In our lab, the two handshakes run one after the other. In practice, they don’t have to, as WireGuard knows nothing about Rosenpass and simply uses the latest key it received at its next handshake.

On a tunnel in use, that’s nothing. Applied to an afternoon of work on our own WireGuard VPN, Rosenpass would have added 0.13% to the traffic, against 0.02% for WireGuard’s own handshakes.

OpenVPN runs its key exchange inside a TLS handshake, so making it quantum-safe means making TLS quantum-safe. On OpenSSL 3.5 or later, it can negotiate the same hybrid X25519MLKEM768 key exchange as browsers. The cost is the one we measured in our TLS post: a few kilobytes per handshake and no noticeable delay.

Authentication is another story. OpenVPN usually authenticates both server and client with X.509 certificates, and moving them to ML-DSA makes every certificate and signature several times larger.

IPsec also follows the hybrid approach for the key exchange. Peers can run additional key exchanges after the classical one, and the IETF is standardizing ML-KEM as the post-quantum one. For authentication, IPsec uses either certificates, with the same ML-DSA size question as OpenVPN, or pre-shared keys, which leaves it to the administrator to exchange them securely.

Its main drawback is that it never rests. Rosenpass renews the key every two minutes, even on an idle tunnel. A lazy mode, renewing only while traffic flows the way WireGuard does, would remove most of that cost. We don’t know if the Rosenpass team plans one, and it would come with a trade-off. When traffic resumes, WireGuard would either wait for a fresh key, adding Rosenpass’s round trips to the first packets, or start on an older one.

Plan to migrate your VPNs to post-quantum cryptography now, and protect the services inside them on their own too. It starts with a cryptographic inventory: which tunnels still run a classical key exchange, and which internal services rely on them for their secrecy.