mirror of
https://github.com/netbirdio/docs.git
synced 2026-04-21 01:46:35 +00:00
71 lines
3.7 KiB
Plaintext
71 lines
3.7 KiB
Plaintext
import {Note} from "@/components/mdx";
|
|
|
|
# Enable post-quantum cryptography
|
|
Post-quantum cryptography aims to mitigate risks associated with quantum computing's potential to undermine existing encryption methods.
|
|
Current concerns include the possibility of bad actors collecting encrypted network traffic to decrypt it once quantum computers become available.
|
|
This 'harvest and decrypt later' strategy threatens the confidentiality of presently secure communications.
|
|
[Rosenpass](https://rosenpass.eu), a post-quantum secure protocol, addresses these concerns by offering advanced cryptographic measures to protect VPN connections against such future threats.
|
|
|
|
|
|
## About Rosenpass
|
|
[Rosenpass](https://rosenpass.eu) is a post-quantum secure key-exchange protocol that enhances [WireGuard](https://www.wireguard.com/) VPNs against quantum computer attacks.
|
|
It employs advanced cryptographic methods [Classic McEliece](https://classic.mceliece.org) and [Kyber](https://pq-crystals.org/kyber/).
|
|
The software is [open-source](https://github.com/rosenpass/rosenpass) and designed for easy integration with existing WireGuard installations.
|
|
It ensures future-proof security against quantum threats by continuously generating and rotating WireGuard pre-shared keys every two minutes.
|
|
Rosenpass can also be used as a generic key-exchange mechanism for other protocols.
|
|
|
|
Starting [v0.25.4](https://github.com/netbirdio/netbird/releases), the NetBird agent runs an embedded Rosenpass server
|
|
that automatically rotates and applies WireGuard pre-shared keys to every point-to-point connection.
|
|
<Note>
|
|
NetBird uses a [Golang implementation](https://github.com/cunicu/go-rosenpass) of the Rosenpass protocol by the [cunīcu](https://cunicu.li) project.
|
|
</Note>
|
|
|
|
## Enable Rosenpass in NetBird
|
|
<Note>
|
|
This is still an experimental feature, may contain bugs, and is not supported on mobile devices.
|
|
</Note>
|
|
Rosenpass can be enabled by setting a flag on client start-up.
|
|
```bash
|
|
netbird up --enable-rosenpass
|
|
```
|
|
Rosenpass respects a provided pre-shared key and uses it for its initial key generation. It is possible to define a manually generated pre-shared key.
|
|
```bash
|
|
netbird up --enable-rosenpass --preshared-key <preshared-key>
|
|
```
|
|
This configuration is persistent and preserved by the agent during restarts.
|
|
|
|
<Note>
|
|
If the Rosenpass feature is enabled on a peer it will only be able to communicate with other peers that have Rosenpass enabled.
|
|
</Note>
|
|
|
|
## Disable Rosenpass
|
|
|
|
To disable Rosenpass again use the following command.
|
|
```bash
|
|
netbird down
|
|
netbird up --enable-rosenpass=false
|
|
```
|
|
|
|
## Enable permissive mode
|
|
|
|
Enabling Rosenpass on one peer assumes that all peers have Rosenpass enabled. If one of the peers does not enable this feature
|
|
or run an older version that lacks Rosenpass, the connection won't work.
|
|
To allow non-Rosenpass enabled peers to connect to a Rosenpass peer, the permissive mode can be activated. In this case,
|
|
the NetBird client will default to a standard WireGuard connection without pre-shared keys for those connections that
|
|
don't support Rosenpass. It will continue negotiating PSKs with Rosenpass for the rest, ensuring enhanced security wherever possible:
|
|
|
|
```bash
|
|
netbird up --enable-rosenpass --rosenpass-permissive
|
|
```
|
|
|
|
|
|
## Get started
|
|
<p float="center" >
|
|
<Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>
|
|
</p>
|
|
|
|
- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird)
|
|
- Follow us [on Twitter](https://twitter.com/netbird)
|
|
- Join our [Slack Channel](https://join.slack.com/t/netbirdio/shared_invite/zt-vrahf41g-ik1v7fV8du6t0RwxSrJ96A)
|
|
- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub
|