Surfshark Completes Full Post-Quantum WireGuard Implementation with ML-DSA Certificates

• Surfshark has integrated ML-DSA certificates into WireGuard to achieve full post-quantum security.
• The upgrade focuses on server authentication to prevent future session takeovers.
• The feature is currently live for users on iOS, macOS, and Windows.

Quantum computers might still sound like science fiction, but cybersecurity experts are already preparing for the day these super‑powered machines can effortlessly crack today’s encryption. Now, Surfshark has taken a major step toward quantum‑proofing daily browsing.

The popular VPN provider announced the completion of its full post‑quantum WireGuard implementation. By tackling the intricate challenge of server authentication, the company claims it has secured every pillar of a private connection against future quantum threats.

While many tech giants and rival VPNs have begun integrating basic post‑quantum key exchanges, fully securing the authentication process remains rare. Surfshark’s latest update ensures bad actors armed with futuristic quantum technology cannot impersonate VPN servers and hijack connections.

The ‘forgotten’ pillar of quantum security

Earlier this year, Surfshark rolled out post‑quantum encryption and key exchanges (known as ML‑KEM) to the WireGuard protocol. Other providers have taken similar steps, with rivals like NordVPN extending post‑quantum protection across their applications.

Now Surfshark has added the final critical component: certificates using ML‑DSA (a digital‑signature algorithm) for authentication.

“A truly full post‑quantum secure VPN rests on three pillars: encryption, key exchange, and authentication. While the industry has widely adopted quantum‑safe encryption and key exchange (like ML‑KEM), authentication remains the ‘forgotten’ step,” explained Karolis Kaciulis, Leading System Engineer at Surfshark.

“Many, including Big Tech, hesitate here because certificates for authentication are difficult to scale and currently lack a global public infrastructure for post‑quantum certificates.”

Beating Big Tech to the punch

Why does authentication matter for the average user? If an attacker uses a quantum computer to break a VPN’s authentication layer, they can perform a session takeover, essentially pretending to be the secure server as you connect and intercept all your data.

“However, ignoring this last step creates a vulnerability when quantum computers become accessible,” Kaciulis said. “At Surfshark, we took the ML‑DSA standards and integrated them with our certificates into a protocol to make authorization fully quantum‑resistant. By using ML‑DSA certificates, we have completed the final pillar, achieving the first full post‑quantum WireGuard implementation.”

This milestone stems from the launch of Dausos, Surfshark’s proprietary VPN protocol engineered with complete post‑quantum security from the ground up, which paved the way for this WireGuard upgrade.

Remarkably, Surfshark is deploying a level of security rarely seen in the consumer space. An internal evaluation of 15 major tech platforms found that only two—AWS KMS and Google Cloud KMS—have actually deployed ML‑DSA, and both are cloud key‑management services, not consumer applications.

While giants like Apple and Microsoft have access to ML‑DSA, neither has enabled it by default in primary user‑facing software such as Safari or Edge.

“It comes as no surprise that industry peers prioritize implementing ML‑KEM key exchange before placing authentication on their engineering roadmaps,” Kaciulis noted.

“Although quantum computing poses no immediate threat today, delaying authentication security until these machines emerge leaves connections vulnerable. That is why Surfshark is taking proactive measures to deliver complete post‑quantum defense ahead of potential quantum threats.”

Surfshark’s fully post‑quantum WireGuard implementation is currently available to users on iOS, macOS, and Windows, with plans to bring support to additional platforms in future releases.

To read more about this upgrade, check Surfshark’s blog post outlining the move to post‑quantum security.

Source link