WireGuard-AES: Hardware based encryption to WireGuard for VPN gateways

M. F. Yuce; O. Keskin; E. Yerlikaya; M. Y. Akmaz; A. Kirca; D. Yiltas-Kaplan; M. A. Erturk; Z. Gurkas-Aydin; C. Turna; M. T. Buyukakkaslar; Durukan-Odabaşı; M. A. Aydin

doi:10.1016/j.softx.2025.102314

WireGuard-AES: Hardware based encryption to WireGuard for VPN gateways

M. F. Yuce
, O. Keskin
, E. Yerlikaya
, M. Y. Akmaz
, A. Kirca
, D. Yiltas-Kaplan
, M. A. Erturk
, Z. Gurkas-Aydin
, C. Turna^*
, M. T. Buyukakkaslar
, Durukan-Odabaşı
, M. A. Aydin

^*Corresponding author for this work

Ulak Haberlesme A.S
Department of Computer Engineering
Istanbul University - Cerrahpaşa
Edinburgh Napier University
Istanbul University
Department of Computer Engineering

Research output: Contribution to journal › Article › peer-review

1 Citation (Scopus)

Abstract

WireGuard is a high-performance virtual private network (VPN) implemented in the Linux kernel, known for its speed and software-based encryption. However, it struggles as a VPN gateway (VPNGW) due to reduced throughput when multiple clients connect—especially in software-defined networks (SDNs), where hardware encryption support is underutilized. This study introduces a novel WireGuard implementation using Advanced Encryption Standard (AES) encryption, leveraging hardware support to improve performance. Kernel-based AES boosts throughput by 11%, reduces retransmissions by 5.5%, and lowers central processing unit (CPU) usage by at least 2% (with 95% confidence interval). User-space AES achieves up to 19% higher throughput on modern CPUs, paving the way for increased speeds and better efficiency with larger maximum transmission units (MTUs).

Original language	English
Article number	102314
Journal	SoftwareX
Volume	31
DOIs	https://doi.org/10.1016/j.softx.2025.102314
Publication status	Published - Sept 2025
Externally published	Yes

Bibliographical note

Publisher Copyright:
© 2025 The Authors

Keywords

AES
Throughput
Virtual private network
VPN
WireGuard

Access to Document

10.1016/j.softx.2025.102314

Cite this

@article{859a585763174929b3d9a1d37960250c,

title = "WireGuard-AES: Hardware based encryption to WireGuard for VPN gateways",

abstract = "WireGuard is a high-performance virtual private network (VPN) implemented in the Linux kernel, known for its speed and software-based encryption. However, it struggles as a VPN gateway (VPNGW) due to reduced throughput when multiple clients connect{\textemdash}especially in software-defined networks (SDNs), where hardware encryption support is underutilized. This study introduces a novel WireGuard implementation using Advanced Encryption Standard (AES) encryption, leveraging hardware support to improve performance. Kernel-based AES boosts throughput by 11\%, reduces retransmissions by 5.5\%, and lowers central processing unit (CPU) usage by at least 2\% (with 95\% confidence interval). User-space AES achieves up to 19\% higher throughput on modern CPUs, paving the way for increased speeds and better efficiency with larger maximum transmission units (MTUs).",

keywords = "AES, Throughput, Virtual private network, VPN, WireGuard",

author = "Yuce, \{M. F.\} and O. Keskin and E. Yerlikaya and Akmaz, \{M. Y.\} and A. Kirca and D. Yiltas-Kaplan and Erturk, \{M. A.\} and Z. Gurkas-Aydin and C. Turna and Buyukakkaslar, \{M. T.\} and Durukan-Odaba{\c s}ı and Aydin, \{M. A.\}",

note = "Publisher Copyright: {\textcopyright} 2025 The Authors",

year = "2025",

month = sep,

doi = "10.1016/j.softx.2025.102314",

language = "English",

volume = "31",

journal = "SoftwareX",

issn = "2352-7110",

publisher = "Elsevier B.V.",

}

TY - JOUR

T1 - WireGuard-AES

T2 - Hardware based encryption to WireGuard for VPN gateways

AU - Yuce, M. F.

AU - Keskin, O.

AU - Yerlikaya, E.

AU - Akmaz, M. Y.

AU - Kirca, A.

AU - Yiltas-Kaplan, D.

AU - Erturk, M. A.

AU - Gurkas-Aydin, Z.

AU - Turna, C.

AU - Buyukakkaslar, M. T.

AU - Durukan-Odabaşı,

AU - Aydin, M. A.

PY - 2025/9

Y1 - 2025/9

N2 - WireGuard is a high-performance virtual private network (VPN) implemented in the Linux kernel, known for its speed and software-based encryption. However, it struggles as a VPN gateway (VPNGW) due to reduced throughput when multiple clients connect—especially in software-defined networks (SDNs), where hardware encryption support is underutilized. This study introduces a novel WireGuard implementation using Advanced Encryption Standard (AES) encryption, leveraging hardware support to improve performance. Kernel-based AES boosts throughput by 11%, reduces retransmissions by 5.5%, and lowers central processing unit (CPU) usage by at least 2% (with 95% confidence interval). User-space AES achieves up to 19% higher throughput on modern CPUs, paving the way for increased speeds and better efficiency with larger maximum transmission units (MTUs).

AB - WireGuard is a high-performance virtual private network (VPN) implemented in the Linux kernel, known for its speed and software-based encryption. However, it struggles as a VPN gateway (VPNGW) due to reduced throughput when multiple clients connect—especially in software-defined networks (SDNs), where hardware encryption support is underutilized. This study introduces a novel WireGuard implementation using Advanced Encryption Standard (AES) encryption, leveraging hardware support to improve performance. Kernel-based AES boosts throughput by 11%, reduces retransmissions by 5.5%, and lowers central processing unit (CPU) usage by at least 2% (with 95% confidence interval). User-space AES achieves up to 19% higher throughput on modern CPUs, paving the way for increased speeds and better efficiency with larger maximum transmission units (MTUs).

KW - AES

KW - Throughput

KW - Virtual private network

KW - VPN

KW - WireGuard

UR - https://www.scopus.com/pages/publications/105013742004

U2 - 10.1016/j.softx.2025.102314

DO - 10.1016/j.softx.2025.102314

M3 - Article

AN - SCOPUS:105013742004

SN - 2352-7110

VL - 31

JO - SoftwareX

JF - SoftwareX

M1 - 102314

ER -

WireGuard-AES: Hardware based encryption to WireGuard for VPN gateways

Abstract

Bibliographical note

Keywords

Access to Document

Other files and links

Fingerprint

Cite this