WolfGuard introduces FIPS 140-3 compliance to WireGuard VPNs through a refactored wolfSSL-based implementation. The project replaces WireGuard's cryptographic primitives with SECP256R1 elliptic curve cryptography and AES-256-GCM authenticated encryption, maintaining WireGuard's simplicity while meeting U.S. government security standards. Key components include the wolfguard.ko kernel module and wg-fips configuration tool, which enable seamless integration with existing WireGuard infrastructure.

WolfGuard operates via two main components: the libwolfssl.ko kernel module and the wg-fips user-space utility. The kernel module handles cryptographic operations using wolfSSL's FIPS-validated libraries, while wg-fips manages key generation and configuration through scripts in /etc/wolfguard. Symbolic links allow direct replacement of WireGuard tools (e.g., wg → wg-fips), with safety measures renaming original executables to wg-wireguard during installation. Performance benchmarks show Intel CPU acceleration enables WolfGuard to match or exceed WireGuard's speed on x86 systems, with non-accelerated builds still capable of saturating gigabit networks.

The system maintains full coexistence with WireGuard, allowing simultaneous operation of both VPN implementations. Compressed public key support (WG_USE_PUBLIC_KEY_COMPRESSION) and FIPS-certified builds are available, though the latter requires contacting [email protected] for source archives. Build instructions detail kernel module compilation against specific kernel trees and user-space toolchain setup, emphasizing strict version matching for compatibility.

By aligning WireGuard's cryptography with FIPS 140-3 standards without compromising performance, WolfGuard addresses enterprise security requirements while preserving the original project's usability. The wolfSSL foundation ensures robust cryptographic primitives, with optional verbose debugging for module testing. This refactoring demonstrates how established open-source projects can evolve to meet regulatory demands without sacrificing core functionality.