Embed Notice

A WireGuard packet starts (after the UDP header) with a byte indicating ts type (handshake initiation, handshake response, or data) & 3 reserved bytes.

The handshake initiation follows up with a 32bit (4byte) ID for this peer, diffie-hellman 32byte public key, some "static" data derived from hash of the previous fields & various other cryptography, & a cryptographically-authenticated timestamp.

The response holds both peer's IDs, server's crypto-key, & a cryptographically-authenticated 0.

3/4