Surfshark says WireGuard now has full post-quantum security

Surfshark says it has completed a post-quantum security upgrade for the WireGuard protocol, adding authentication to the encryption and key exchange protections it introduced earlier this year.

The company says the update uses certificates based on ML-DSA, a digital signature algorithm, to authenticate VPN connections. Surfshark describes this as completing three parts of post-quantum protection: encryption, key exchange and authentication. Its earlier WireGuard update added ML-KEM for encryption and key exchange.

Surfshark says post-quantum authentication could help prevent an attacker with a future quantum computer from impersonating a VPN server and taking over a session. The company’s leading system engineer, Karolis Kaciulis, said authentication remains less widely adopted than post-quantum encryption and key exchange, in part because certificates are difficult to scale and lack global public infrastructure.

The upgrade follows Surfshark’s launch of Dausos, its proprietary VPN protocol designed with post-quantum security. Surfshark says an evaluation it conducted of 15 major technology platforms found that only AWS KMS and Google Cloud KMS had deployed ML-DSA; both are cloud key-management services. The company says its WireGuard implementation is available on iOS, macOS and Windows, with support for more platforms planned.