1.4 KiB
1.4 KiB
baalvpn
A hub-and-spoke VPN for IPv6
Features
- Post-quantum security: Uses HPKE(XWingMLKEM768X25519, HKDF-SHA-256) + XChaCha20-Poly1305 for encryption and ML-DSA-44 for signatures.
- NAT-resistant architecture: Any device with Internet access can easily join the network.
- Cross-platform-ish: Tested on Linux and Windows. macOS should probably work too.
Protocol
See proto.go for details
Known limitations
- Compromised server could give out fake pubkeys allowing a MITM attack and decrypting the peer-to-peer traffic
- The keys are rotated only on client and server restart
- The protocol is vulnerable to replay attacks
Third-party dependencies
github.com/songgao/water- wrapper around TUN interfaces for *nixgolang.zx2c4.com/wintun- wrapper aroundwintun.dllgithub.com/cloudflare/circl- used for ML-DSA, hopefully not for long