3 ms·
They maintain separate peers for Pre-quantum and Post-quantum so that connectivity isn't interrupted. Each Pre-quantum peer is implicitly paired with a corresp
by d-z-m 4y ago
They maintain separate peers for Pre-quantum and Post-quantum so that connectivity isn't interrupted. Each Pre-quantum peer is implicitly paired with a corresponding Post-quantum peer. Negotiating the PSK happens over a grpc api they expose at `10.64.0.1:1337`. The spec is public, if you're curious: https://github.com/mullvad/mullvadvpn-app/blob/main/talpid-tunnel-config-client/proto/tunnel_config.proto https://github.com/mullvad/mullvadvpn-app/blob/main/talpid-t...
If you're a fuddy-dud like me who uses the Vanilla WireGuard config files, I wrote a tool to upgrade your pre-quantum peer to a post-quantum one. https://github.com/d-z-m/pq-adapter-mullvad https://github.com/d-z-m/pq-adapter-mullvad
- deleted 4y ago[deleted]
- rogers18445 4y agoNice. But I think you missed an update, Mullvad now also uses Kyber, your tool doesn't appear to. You also don't need Go: https://github.com/mullvad/mullvadvpn-app/blob/main/talpid-tunnel-config-client/examples/psk-exchange.rs https://github.com/mullvad/mullvadvpn-app/blob/main/talpid-t...
- d-z-m 4y agoI'm intentionally not using Kyber, the key xor only happens if you elect to use both. It works just fine with McEliece only. > You also don't need Go You don't need any language in particular. That's the beauty of the .proto spec. Can generate some client(and server) code in whatever language you want(that protoc supports).
- rogers18445 4y agoDo you have a reason to not use Kyber? The way it is combined should be sound.
- d-z-m 4y agoNot in particular. Yes, the way they are combining them should be sound.