Tunnels and protocols
Keys, handshakes, and peers
See how peers authenticate each other, establish fresh session keys, and keep long-term private keys out of configuration sharing.
8 minute lesson
Each WireGuard peer has a private key and a public key. You share the public key and protect the private key. There are no usernames, no certificates, no accounts. A peer is its key pair.
If you have used SSH keys, this model is familiar. The public key can travel anywhere — chat, email, a config file in a repo. The private key never leaves the device it was generated on.
When two peers first exchange traffic, they perform a handshake. Each side proves it holds its private key, and together they derive fresh symmetric session keys that protect the actual traffic. The peers rotate session keys while the long-term identity remains stable — under active traffic, WireGuard performs a new handshake roughly every two minutes. A stolen session key exposes only a small window of traffic, never the whole history.
You can watch this machinery work:
sudo wg show
# interface: wg0
# public key: hIhpm5DfIhSNQvvBpG0fWo6yQqYamOoO70QI0DGkfBM=
# listening port: 51820
#
# peer: xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=
# endpoint: 198.51.100.44:53200
# latest handshake: 34 seconds ago
# transfer: 1.24 MiB received, 861.32 KiB sentThe latest handshake line is the most useful diagnostic in all of WireGuard. A recent handshake proves both sides hold the right keys and can exchange UDP. No handshake at all means identity or connectivity failed — nothing else is worth checking until that line appears.
WireGuard does not distribute keys or decide who should receive them. There is no login server, no revocation list. That operational work still belongs to you: generate keys on each device, copy public keys between configs, and remove them when access should end.
Treat a peer key like an access credential. Remove it when the device is lost or no longer authorized:
sudo wg set wg0 peer xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg= removeOne mistake to avoid: copying a single private key to a second device because it seems convenient. Two devices then claim the same identity, and the endpoint flips between their addresses as each one talks. Connections stall in confusing ways. Every device gets its own pair, always.
Lesson completed