← Knowledge base

WireGuard

WireGuard’s protocol uses Curve25519 and can mix an optional pre-shared key into its handshake. The existence of that key does not establish how it was generated or exchanged.

Evidence to collect

  1. Assess the tunnel’s key-management design separately from any HTTPS service inside it.
  2. If an additional post-quantum exchange system is used, verify its protocol, peer identity, successful exchanges, and key rotation through non-secret status evidence.
  3. Never print or share pre-shared keys as a readiness check. A populated PSK field is not proof that a particular exchange daemon is active.

Read-only inventory

Run this in the environment used by the application. Missing commands mean the tool is unavailable. This output is inventory, not a negotiation result.

wg --version

Record the scope and result

Record the tested component, client, peer, protocol, selected algorithm, and date. Keep observed negotiation, documented capability, and unknown distinct. A failed check can reflect local tooling, certificate validation, network policy, or configuration; it does not prove that all PQC is unsupported.

Official references

Guidance reviewed 24 September 2026. Verify documentation for your deployed release; vendor capabilities and defaults change.