B
BetterSign
· WireGuard identity, post-quantum
1 / 3
‹
›
Every WireGuard peer hardcodes every other peer’s public key
🔗 peer-a
✗ reconfigure
[Peer]
PublicKey =
…old
PresharedKey =
none (not PQ)
🔗 peer-b
✗ reconfigure
[Peer]
PublicKey =
…old
PresharedKey =
none (not PQ)
Rotate a peer key and you must edit every peer’s config by hand — and the tunnel has no protection against a future quantum computer.
A peer’s identity is a VLAD:
vlad:z6Mk…peer-a
Entry N
/wg/key: k0
signed ✓
→
Entry N+1 · rotate
/wg/key:
k1 (new)
signed by k0 ✓
+ a post-quantum key exchange derives a PresharedKey, hardening the tunnel against future quantum attacks
Rotating the VPN key is
one signed plog entry
— the peer identity never changes.
Each peer follows the VLAD, verifies the change, and rewrites its WireGuard config automatically
🔗 peer-a
OLD
✓ tunnel up
[Peer]
PublicKey =
…old
…new
PresharedKey =
none
…PQ-derived
🔗 peer-b
OLD
✓ tunnel up
[Peer]
PublicKey =
…old
…new
PresharedKey =
none
…PQ-derived
Tunnel stayed up
— every peer reconfigured itself · now post-quantum protected · 0 configs hand-edited