Privacy-preserving VPN handshakes with Schnorr-based zero-knowledge proofs

Yuce M. F., ERTÜRK M. A., AYDIN M. A.

Computers and Security, cilt.166, 2026 (SCI-Expanded, Scopus) identifier

  • Yayın Türü: Makale / Tam Makale
  • Cilt numarası: 166
  • Basım Tarihi: 2026
  • Doi Numarası: 10.1016/j.cose.2026.104887
  • Dergi Adı: Computers and Security
  • Derginin Tarandığı İndeksler: Science Citation Index Expanded (SCI-EXPANDED), Scopus, ABI/INFORM, Compendex, Criminal Justice Abstracts, INSPEC
  • Anahtar Kelimeler: NIZK, Privacy-preserving authentication, VPN handshake, WireGuard
  • İstanbul Üniversitesi Adresli: Evet

Özet

Modern Virtual Private Network (VPN) protocols rely on public-key-based handshakes that authenticate peers but can inadvertently reveal identifying or linkable information across sessions or network observers. This paper presents a privacy-preserving handshake framework that integrates Schnorr-based zero-knowledge proofs into existing VPN key-exchange mechanisms, allowing each party to prove key ownership without disclosing long-term identifiers such as static public keys. The framework is expressed as a generic extension layer applicable to a wide class of VPN protocols employing Diffie-Hellman-based mutual authentication (e.g., IKEv2/IPsec, OpenVPN, and WireGuard). To demonstrate feasibility, we integrate the scheme into WireGuard as a case study, yielding WireGuard-ZK. Implementation results show that the added privacy protection incurs modest computational and latency overhead while maintaining WireGuard's lightweight performance characteristics. The proposed design thus provides a generalizable cryptographic handshake model for privacy-preserving VPNs, combining theoretical soundness with practical deployability across modern tunneling frameworks.