Jason A. Donenfeld, the author of VPN WireGuard, has introduced the first significant release of the WireGuard client software for Windows 1.0, along with drivers WireGuardNT 1.0 featuring a port. VPN WireGuard for Windows 10 and 11 kernels supports AMD64, x86, and ARM64 architectures. The kernel components code for Windows is distributed under the GPLv2 license, while the client software is under the MIT license.
The port is based on the codebase of the main WireGuard implementation for the Linux kernel, which has been adapted to use Windows kernel entities and the NDIS network stack. Compared to the wireguard-go implementation that runs in user space and uses the Wintun network interface, WireGuardNT offers a significant performance boost by eliminating context-switching operations and copying packet content from kernel to user space. Similar to implementations for Linux, OpenBSD, and FreeBSD, all protocol processing logic in WireGuardNT operates directly at the networking stack level.
Version 1.0 is marked as a milestone, signifying the resolution of several issues and the achievement of planned tasks, such as utilizing the NdisWdfGetAdapterContextFromAdapterHandle() function instead of the less secure practice of storing driver state in the Reserved field and using undocumented offsets; accurately and timely tracking of MTU (Maximum Transmission Unit) size through syscall interception; and employing C23 standard code.
It is worth noting that VPN WireGuard is built on modern encryption methods, providing very high performance, ease of use, and eliminating complexities, while having proven itself in several large deployments handling substantial traffic volumes. The project has been developing since 2015 and has undergone audits and formal verification of the applied encryption techniques. WireGuard employs the concept of key routing, which involves binding a private key to each network interface and using it for associating public keys.
The exchange of public keys to establish a connection is conducted similarly to SSH. To negotiate keys and connect without launching a separate user-space daemon, the Noise_IK mechanism from the Noise Protocol Framework is applied, akin to maintaining authorized_keys in SSH. Data transmission occurs through encapsulation in UDP packets. Support is provided for changing an IP address VPN servers (roaming) without connection interruptions and automatic client reconfiguration.
The ChaCha20 stream cipher and the Poly1305 message authentication code (MAC) algorithm are used for encryption, developed by Daniel J. Bernstein, Tanja Lange, and Peter Schwabe. ChaCha20 and Poly1305 are positioned as faster and more secure alternatives to AES-256-CTR and HMAC, with a software implementation that achieves fixed execution time without requiring specialized hardware support. The Diffie-Hellman protocol on elliptic curves using Curve25519, also proposed by Daniel J. Bernstein, is used to generate the shared secret key. The BLAKE2s algorithm (RFC7693) is used for hashing.
Source: opennet.ru
