Noise protocol

The Noise Protocol Framework is a set of building blocks for designing handshakes based on Diffie-Hellman key agreement. Instead of one fixed protocol, Noise describes a handshake as a pattern: which public keys each side sends, in which message, and which key agreements they perform along the way. A complete Noise protocol pairs a pattern with a choice of curve, cipher and hash. When the handshake finishes, both sides hold shared keys for encrypting traffic. Nebula and WireGuard are both built on Noise, using different patterns.

Noise in Nebula

Nebula’s handshake uses the IX pattern. In Noise’s naming, the first letter describes the initiator’s static (long-term) key and the second describes the responder’s. “I” means the initiator sends its static key immediately, in the first message, and “X” means the responder transmits its static key during the handshake. Neither side needs to know the other’s key in advance.

That’s what lets Nebula use certificates. A host’s static key is the public key in its certificate, and the certificate itself travels in the handshake message alongside it. The receiving host checks the certificate against the network’s CA, as described in PKI, rather than against a list of keys it was given beforehand. The first message is sent before any keys are agreed, so the initiator’s certificate isn’t encrypted. Certificates hold no secrets, but they do include the host’s name, overlay IP and groups.

For the rest of the recipe, Managed Nebula uses Curve25519 or NIST P-256 for key agreement, AES-256-GCM as the cipher, and SHA-256 as the hash (see Cipher).

Noise in WireGuard

WireGuard uses the IK pattern. “K” means the initiator already knows the responder’s static key before the handshake starts, which is why every WireGuard peer has to be configured with the public keys of the peers it talks to. With IX and certificates, a new Nebula host can connect to existing hosts as soon as it’s enrolled. The Nebula vs WireGuard comparison covers the other differences.