Enable post-quantum cryptography

Post-quantum cryptography aims to mitigate risks associated with quantum computing's potential to undermine existing encryption methods. Current concerns include the possibility of bad actors collecting encrypted network traffic to decrypt it once quantum computers become available. This 'harvest and decrypt later' strategy threatens the confidentiality of presently secure communications. Rosenpass, a post-quantum secure protocol, addresses these concerns by offering advanced cryptographic measures to protect VPN connections against such future threads.

About Rosenpass

Rosenpass is a post-quantum secure key-exchange protocol that enhances WireGuard VPNs against quantum computer attacks. It employs advanced cryptographic methods Classic McEliece and Kyber. The software is open-source and designed for easy integration with existing WireGuard installations. It ensures future-proof security against quantum threats by continuously generating and rotating WireGuard pre-shared keys every two minutes. Rosenpass can also be used as a generic key-exchange mechanism for other protocols.

Starting v0.25.4, the NetBird agent runs an embedded Rosenpass server that automatically rotates and applies WireGuard pre-shared keys to every point-to-point connection.

Enable Rosenpass in NetBird

Rosenpass can be enabled by setting a flag on client start-up.

netbird up --enable-rosenpass

Rosenpass respects a provided pre-shared key and uses it for its initial key generation. It is possible to define a manually generated pre-shared key.

netbird up --enable-rosenpass --preshared-key <preshared-key>

This configuration is persistent and preserved by the agent during restarts.

Disable Rosenpass

To disable Rosenpass again use the following command.

netbird down
netbird up --enable-rosenpass=false

Get started