baalvpn

A hub-and-spoke VPN for IPv6

Features

• Post-quantum security: Uses HPKE(XWingMLKEM768X25519, HKDF-SHA-256) + XChaCha20-Poly1305 for encryption and ML-DSA-44 for signatures.

Protocol

See proto.go

Third-party dependencies

• github.com/songgao/water - cross-platform wrapper around TUN interfaces
• github.com/cloudflare/circl - used for ML-DSA, hopefully not for long