Enable post-quantum cryptography
Post-quantum cryptography aims to mitigate risks associated with quantum computing's potential to undermine existing encryption methods. Current concerns include the possibility of bad actors collecting encrypted network traffic to decrypt it once quantum computers become available. This 'harvest and decrypt later' strategy threatens the confidentiality of presently secure communications. Rosenpass, a post-quantum secure protocol, addresses these concerns by offering advanced cryptographic measures to protect VPN connections against such future threads.
Rosenpass is a post-quantum secure key-exchange protocol that enhances WireGuard VPNs against quantum computer attacks. It employs advanced cryptographic methods Classic McEliece and Kyber. The software is open-source and designed for easy integration with existing WireGuard installations. It ensures future-proof security against quantum threats by continuously generating and rotating WireGuard pre-shared keys every two minutes. Rosenpass can also be used as a generic key-exchange mechanism for other protocols.
Starting v0.25.4, the NetBird agent runs an embedded Rosenpass server that automatically rotates and applies WireGuard pre-shared keys to every point-to-point connection.
Rosenpass can be enabled by setting a flag on client start-up.
netbird up --enable-rosenpass
Rosenpass respects a provided pre-shared key and uses it for its initial key generation. It is possible to define a manually generated pre-shared key.
netbird up --enable-rosenpass --preshared-key <preshared-key>
This configuration is persistent and preserved by the agent during restarts.
To disable Rosenpass again use the following command.
netbird up --enable-rosenpass=false