We are pleased to announce wolfConnect, a post-quantum Private Network written in C on top of wolfCrypt. wolfConnect transparently establishes end-to-end, post-quantum-encrypted tunnels to any server that advertises support, with no changes to the applications riding on top. It is a re-implementation of the PQConnect protocol presented at NDSS 2025, derived from the upstream 1.2.3 release tarball.
The implementation is organized as a stack of small, independently tested modules:
- crypto primitives
- stateless cookie engine for handshake DoS mitigation
- key server
- tunnel key ratchet
- 0-RTT hybrid-KEM handshake
- packet engine
As of today, there are 616 tests, but 4 are usually skipped because they require root privileges.
The most visible difference from upstream PQConnect is the cryptographic algorithm choices. PQConnect uses Classic McEliece and NTRU Prime; wolfConnect substitutes ML-KEM-1024 for the long-term server KEM, ML-KEM-768 for the ephemeral session KEM, X25519 for the hybrid ECC layer, ChaCha20-Poly1305 for packet AEAD, and SHAKE-256 with a ChaCha20 stream for hashing and key derivation. The transport is UDP only, with the tunnel carrying arbitrary IP inside.
The second difference is in the protocol itself: the PKTree Merkle-tree static-key fetch with a single-packet key exchange is no longer needed as the ML-KEM public key is small enough.
The third difference is one of language and target. PQConnect is a Python reference implementation; wolfConnect is C, links wolfCrypt directly, and is aimed at embedded systems where a Python runtime is not an option.
As a simple demo to get started, a single-host demo script brings up a server, a client, and a throwaway loopback DNS resolver, establishes a real post-quantum tunnel, and pushes a ping through it.
Curious about this new approach to PQC and network tunneling? If you have questions about any of the above, please contact us at facts@wolfssl.com or call us at +1 425 245 8247.
Download wolfSSL Now