User-Space PQ Key Exchange in WireGuard Using ML-KEM-768

This paper presents a user-space integration of ML-KEM-768, a post-quantum key encapsulation mechanism, with WireGuard, a modern VPN protocol. Rather than modifying the Diffie-Hellman handshake of the X25519 elliptic curve at kernel level, the proposed approach establishes a Kyber-based shared secret over the sockets. It injects it as a Pre-Shared Key (PSK) into WireGuard’s Noise protocol. This enhances WireGuard’s resistance to quantum attacks without altering its core code. Experimental results demonstrate successful key agreement and acceptable performance overhead, making the solution viable for hybrid VPN deployments in the post-quantum era.