WireGuard
termnetworkingcryptography
A VPN protocol built around a deliberately small codebase and a fixed set of modern cryptographic choices, with no negotiation.
The absence of negotiation is the design argument. IPsec and TLS let two ends agree on algorithms, which is flexible and is also where downgrade attacks and configuration mismatches live; WireGuard removes the conversation by shipping one suite and versioning the whole protocol if it must change. The trade is real: no algorithm agility means a break in one primitive requires a new protocol version everywhere, and the small feature set pushes identity, policy and address assignment out to whatever wraps it.
Also known as: wg