How WireGuard works: SSH-ified VPN

The older VPN protocols grew into configuration swamps — IPsec's negotiable everything, OpenVPN's large TLS-based surface — where most failures and most vulnerabilities live in the negotiation and the options, not the encryption. WireGuard's founding decision is subtraction: one fixed, modern cipher suite, no negotiation, a tiny codebase, running in the kernel. The one-line summary: a VPN rebuilt the way SSH feels.

Identity is a keypair, exactly like SSH. Each peer has a static private/public key pair; to trust a peer you list its public key, the way authorized_keys works. There are no accounts, no certificates, no usernames. And a peer that cannot authenticate is met with silence: WireGuard sends no response at all to unauthenticated packets, so to a scanner the machine simply is not there.

The 1-RTT handshake — and why it can be one round trip. Because both sides' static public keys are known in advance, there is nothing to negotiate and no identity to exchange: the very first packet can already carry encrypted payload, keyed under a session key derived from the static keys plus fresh ephemerals (the Noise_IK pattern). Compare SSH's or TLS's longer openings: they spend round trips agreeing on algorithms and presenting credentials. WireGuard pre-agreed everything at configuration time, so the handshake is one round trip and done.

Cryptokey routing: the routing table and the access list are the same table. Each peer entry pairs a public key with its allowed IPs. Outbound, the table picks which key encrypts for a given destination address. Inbound, after decryption, the packet's source address must fall inside that peer's allowed range or it is dropped. Routing decision and identity check collapse into one lookup.

Roaming falls out of key-based identity. A peer's endpoint (its current IP:port) is learned from the last authenticated packet it sent. Move from office Wi-Fi to a phone hotspot and the tunnel survives untouched: the identity is the key, not the address, so the address is free to change.

The boundaries of the SSH analogy — where the one-liner stops: WireGuard is layer 3 (a virtual network interface carrying IP packets between machines), SSH is layer 7 (a session into a user's shell on one machine). WireGuard runs over UDP with no connection state; SSH runs over a stateful TCP connection. The kinship is in identity and restraint — keys instead of accounts, one suite instead of a menu — not in what the two carry.