WireGuard 1.0 for Windows: kernel driver and performance

# WireGuard 1.0 for Windows: Kernel Driver Release and Performance Boost

The first stable versions of WireGuard 1.0 for Windows and the WireGuardNT 1.0 driver have been released, implementing the VPN protocol directly in the kernel of Windows 10 and 11. This marks the transition from user mode to full integration with the NDIS network stack, delivering significant performance gains by eliminating context switches and redundant packet copying.

Architectural Changes in WireGuardNT

Previously, the Windows solution was based on wireguard-go—a user-space implementation that used the Wintun driver to interact with the kernel. Despite its reliability, this approach inevitably incurred overhead: every network packet crossed the boundary between user and privileged modes, slowing down traffic processing, especially under high load.

WireGuardNT eliminates this drawback by placing all protocol logic inside the kernel. The driver is written using NDIS (Network Driver Interface Specification) and fully complies with Windows architectural requirements. It supports three main platforms: AMD64, x86, and ARM64. Critical components, such as MTU handling and adapter state management, are now implemented via official kernel APIs, including NdisWdfGetAdapterContextFromAdapterHandle(), enhancing stability and security.

Cryptographic Foundation of WireGuard

WireGuard maintains a unified cryptographic stack across platforms. It uses the following algorithms:

• ChaCha20 — stream cipher with constant-time execution;
• Poly1305 — MAC algorithm for message authentication;
• Curve25519 — elliptic curve for Diffie–Hellman protocol;
• BLAKE2s — hashing function per RFC 7693.

These components were chosen deliberately: they deliver high speed even without hardware acceleration, resist timing attacks, and have undergone independent verification. Unlike IPsec or OpenVPN, WireGuard uses a minimal set of primitives, reducing the attack surface and simplifying audits.

Connection Establishment and Roaming

The process of establishing a secure channel in WireGuard is similar to key exchange in SSH. Each interface has its own private key, and trusted peers are identified by public keys. Session keys are negotiated using the Noise_IK mechanism from the Noise Protocol Framework.

A key feature of WireGuard is seamless roaming support. If a client changes IP address (e.g., switching from Wi-Fi to mobile data), the server automatically updates the client's location info based on the latest received packet. The connection remains uninterrupted, which is crucial for mobile devices and remote workers.

Technical Improvements in Version 1.0

The 1.0 release is the result of years of refinement. Key changes include:

• Elimination of storing driver state in the kernel structures' Reserved field—now using the standard adapter context mechanism.
• Dynamic MTU tracking via system call interception, preventing packet fragmentation.
• Switch to the C23 standard for the codebase, improving portability and compatibility with modern compilers.
• Full ARM64 support, making it suitable for new generations of Windows devices based on Qualcomm and other SoCs.

Key Points

• WireGuardNT runs entirely in the Windows kernel, providing substantial performance gains compared to wireguard-go.
• Cryptographic stack remains unchanged: ChaCha20, Poly1305, Curve25519, BLAKE2s.
• Seamless roaming without connection drops is supported out of the box.
• The 1.0 release isn't just a version number—it's the completion of architectural stabilization.
• Licensing is split: kernel under GPLv2, client software under MIT.

— Editorial Team