A Post-Quantum Virtual Private Network

A virtual private network encrypts the path between a user's device and the wider internet, preventing the local network, the internet service provider, and on-path observers from reading or tampering with traffic. Modern VPNs have largely standardized on WireGuard, a minimal and formally analyzed protocol that provides strong forward secrecy with classical elliptic-curve cryptography.

That classical foundation is the problem. WireGuard's Curve25519 key exchange, like the elliptic-curve and RSA cryptography securing the rest of the internet, is vulnerable to Shor's algorithm on a cryptographically relevant quantum computer (CRQC). The "harvest now, decrypt later" attack makes this urgent today: a well-resourced adversary can passively record encrypted VPN traffic now and decrypt it years later once a CRQC exists. A VPN tunnel is a high-value target for this attack because it carries the user's entire connection in a single stream.

Most "post-quantum" VPNs, where they exist at all, add a quantum-resistant key exchange to the tunnel and stop there, leaving the control API, server authentication, software-update channel, and DNS resolver on purely classical cryptography. Secria VPN takes a different position: post-quantum protection at every layer. This paper documents how each layer is constructed and why.

Secria VPN is designed to defeat ISP and network-level surveillance, IP-based tracking by websites and services, and future quantum decryption of recorded sessions. We state its boundaries plainly. Secria VPN does not protect against a compromised endpoint (malware on the user's own device); it cannot defeat a global passive adversary able to correlate traffic at both the entry and exit of the network simultaneously; and, like any hosted service, it cannot offer absolute protection against legal compulsion to modify server code, a risk mitigated, not eliminated, by RAM-only infrastructure and the warrant canary. The account model is pseudonymous rather than fully anonymous, as described in Section 12.

The data tunnel is WireGuard, chosen for its minimal attack surface (roughly four thousand lines in the kernel module), formal analysis, and strong forward secrecy. WireGuard alone performs its key exchange with Curve25519, which is not quantum-resistant. Secria VPN closes that gap using WireGuard's own native preshared-key (PSK) facility.

The PSK is one-shot per connection: a new key is generated on every connect, with no long-running key-exchange daemon and no periodic rotation to drift out of sync. Because the exchange is a client-initiated request/response, the simultaneous-initiation race that affects symmetric post-quantum daemons is structurally impossible, the same production approach used by other leading post-quantum VPNs.

The control plane, the API that handles authentication, server assignment, and tunnel setup, runs over TLS 1.3 only, with legacy cipher suites removed. Its key exchange is the X25519+ML-KEM-768 hybrid, so control traffic is also resistant to harvest-now-decrypt-later attacks rather than only the data tunnel.

Internal connections between the central API and each node agent use mutual TLS with short-lived Ed25519 certificates issued by a private Ed25519 certificate authority. Because these certificates authenticate a channel that is already post-quantum-protected by the hybrid key exchange, and because they are short-lived and rotatable, classical Ed25519 is appropriate here: forging one would require breaking Ed25519 in real time rather than offline, and confidentiality never depends on the certificate algorithm. For public-facing server authentication, Secria VPN additionally uses ML-DSA-65 (FIPS 204) post-quantum signatures.

Session tokens are signed with Ed25519. Access tokens are short-lived; refresh tokens are single-use and rotated on every use. User passwords are hashed with Argon2id using OWASP-recommended memory-hard parameters.

Every Secria VPN node runs entirely on a RAM-backed filesystem. No keys, configuration, connection state, or logs are written to persistent disk. WireGuard private keys exist only in kernel memory; the post-quantum preshared keys live only in RAM for the life of a connection. Powering a server off, or seizing it, destroys all volatile state and yields no historical user data.

Egress is constrained at the host firewall so that node traffic cannot leak outside the intended paths, and node health reports contain only coarse, bucketed aggregate metrics, such as ranges of peer counts, rather than exact figures that could fingerprint individual users.

Native clients for iOS, macOS, Android, Windows, and Linux pin the API server's TLS certificate by SHA-256 SPKI hash, so a fraudulently issued certificate is rejected even if a certificate authority is compromised. All release artifacts, the Linux CLI, node agent, Windows installer, macOS disk image, and Android APK, are signed with SLH-DSA (FIPS 205) during the release pipeline, and the checksum manifest is signed as well. SLH-DSA relies only on the security of hash functions, the most conservative post-quantum assumption, so the update channel resists supply-chain forgery even against a quantum adversary. Users installing the Android APK directly can verify its published SHA-256 hash before installation.

Operational transparency is provided by a warrant canary signed with SLH-DSA-SHA2-256s; clients can verify the signature, and its absence is a signal in itself.

Secria VPN uses a deliberately pseudonymous, not fully anonymous, account model, and documents the trade-off openly. An account requires an email address, which may be a disposable alias and is never verified for domain ownership, plus a payment identifier. This is necessary for abuse prevention and device-cap enforcement, for billing, for letting users see and revoke their own devices, and for account recovery. For maximum payment privacy, Secria VPN accepts Monero alongside Bitcoin and card payments. The VPN is bundled with the Secria account: it can be subscribed on its own, or together with Secria Mail under a single plan.

Secria VPN extends post-quantum protection beyond the tunnel to the entire service. The WireGuard data path is reinforced with a per-connection ML-KEM-768 preshared key; the control API uses hybrid post-quantum TLS; server software and release binaries are authenticated with ML-DSA and SLH-DSA; DNS is resolved privately with DNSSEC; and traffic can be routed through a three-layer multi-hop circuit. Underpinning all of it, every node runs in RAM under a strict no-logs policy, so there is nothing to seize and nothing to surrender.

Where most VPNs secure one layer with classical cryptography and call it private, Secria VPN is built so that the data captured today cannot be unlocked by the computers of tomorrow, at every layer, by default.

Your connection carries your whole digital life. It deserves cryptography built for the future, not the past.