A modern, simple VPN protocol.
The idea: WireGuard is deliberately minimal. Each peer is identified by a static X25519 public key configured in advance, and a short handshake (the Noise framework) combines static and fresh Diffie-Hellman exchanges into session keys, renewed every two minutes. Traffic is sealed with ChaCha20-Poly1305. An optional pre-shared key is mixed in too, which is the hook some VPNs use to add post-quantum protection.
Why it matters: Many VPN apps use it. It isn't quantum-safe by default.
On the map: X25519 + ChaCha20-Poly1305 + BLAKE2s no quantum protection without a PSK
A modern VPN protocol built on the Noise framework[1, 2]: X25519 key exchange, ChaCha20-Poly1305 encryption and BLAKE2s hashing.
Its key exchange is classical X25519 only, so recorded traffic could be decrypted by a future quantum computer unless the optional pre-shared key is used. Some VPN providers fill that slot with the output of a post-quantum key exchange (Mullvad, Rosenpass)[3, 4].
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.