Noise Protocol Framework

WireGuard uses a Noise protocol pattern (Noise_IK) for the handshake. Noise is a framework for crypto handshakes (designed by Trevor Perrin).

Building blocks:

• DH (Curve25519): one base curve.
• AEAD (ChaCha20-Poly1305): symmetric encryption + auth.
• Hash (BLAKE2s): used for KDF, hashing transcripts.

Noise patterns describe handshake message exchanges. Each character means a key exchange:

• N: anonymous (no static key).
• K: static key known to peer in advance.
• I: static key included in initial message.

Noise_IK: initiator includes static key, responder's static key known in advance.

Why Noise?

• Provably secure.
• Compact.
• Patterns let you pick the right tradeoffs (anonymity vs identity, mutual auth vs server-only).

WireGuard's handshake (simplified):

Initiation message (client → server):

- ephemeral pub key
- static pub key (encrypted with derived key)
- timestamp (encrypted, prevents replay)
- MAC1 (over server's static pub) — anti-DOS
- MAC2 (under cookie, optional)

Response message (server → client):

- ephemeral pub key
- empty payload (encrypted)
- MAC1
- MAC2

After both messages, both sides compute the same shared secret. Derive session keys (one for each direction).

Total: 2 messages, 1 RTT for connection setup. Very fast.

Compared to TLS 1.3:

• TLS 1.3: 1-RTT handshake, similar idea.
• WireGuard: simpler (only one cipher suite, no negotiation).
• WireGuard: identity baked in (config file holds peer pub keys).