Enable post-quantum cryptography
An attacker can record encrypted traffic today and try to decrypt it once quantum computers are available. Post-quantum cryptography protects against this "harvest now, decrypt later" risk. The Netzilo client can add a post-quantum layer to its WireGuard tunnels with Rosenpass.
Rosenpass is experimental in the Netzilo client and is not available on Android or iOS.
How it works
Rosenpass is a post-quantum key-exchange protocol for WireGuard. It uses Classic McEliece and Kyber to agree on a WireGuard pre-shared key, and replaces that key every two minutes. The Netzilo client runs a Rosenpass server built in, and applies the keys to every point-to-point connection.
A peer with Rosenpass turned on talks only to peers that also have it, unless you turn on permissive mode.
Turn Rosenpass on
Run on each device:
netzilo up --enable-rosenpass
Rosenpass uses a pre-shared key you give it for its first key exchange:
netzilo up --enable-rosenpass --preshared-key <preshared-key>
In the tray app, the same switch is Advanced > Enable Quantum-Resistance. Run
netzilo status: the line Quantum resistance shows whether it is on.
The setting is saved in the client's configuration. A logout (netzilo down,
netzilo service stop or restart) resets it, so pass --enable-rosenpass again at
the next netzilo up.
Allow peers without Rosenpass
With Rosenpass on, connections to peers that do not have it fail. Permissive mode lets such peers connect with a standard WireGuard tunnel, while Rosenpass keys are still used with every peer that supports them:
netzilo up --enable-rosenpass --rosenpass-permissive
Turn Rosenpass off
netzilo down
netzilo up --enable-rosenpass=false
netzilo down logs the device out. An SSO device needs the person at the device to sign
in again; a setup-key device needs --setup-key again.
Related Documentation
- CLI - all
netzilo upflags - Why WireGuard with Netzilo - the tunnel Rosenpass strengthens