Skip to content
EON Path

EON Path

What is EON Path?

EON Path is a VPN built around post-quantum cryptography. Instead of relying on classical-only key exchange and bearer tokens, it authenticates every client with ML-DSA-87 (FIPS 204) digital signatures, negotiates session key material with ML-KEM-1024 (FIPS 203) key encapsulation, and carries traffic over a standard WireGuard tunnel. The result is a VPN that is fast to use today and resistant to “harvest now, decrypt later” attacks, in which an adversary records encrypted traffic now in the hope of decrypting it once a sufficiently powerful quantum computer exists.

A server daemon terminates tunnels and works with a management API for key lookup; desktop and mobile clients authenticate to it, establish a WireGuard tunnel secured with a post-quantum-derived pre-shared key, and route traffic through it. Where a deployment’s internal network is IPv6-only, EON Path can translate IPv4 traffic to IPv6 and back inside the tunnel using stateless IP/ICMP translation (SIIT), so IPv4-only client applications keep working unmodified.

Key properties

  • Post-quantum authentication. Clients and servers authenticate with ML-DSA-87 public-key signatures in a challenge-response handshake — no passwords, no bearer tokens.
  • WireGuard transport. Once authenticated, traffic flows over a WireGuard tunnel, keeping the low latency and small attack surface WireGuard is known for.
  • Mandatory server identity pinning. Clients verify the server’s ML-DSA-87 identity against a pinned fingerprint (or a DNS TXT record) before trusting it, protecting against endpoint impersonation.
  • IPv4 ↔ IPv6 translation (SIIT). Stateless translation lets IPv4 client traffic reach IPv6-only server networks without extra configuration on the client.
  • Multi-server clients. A client is configured with several server endpoints rather than a server with many clients, and the mobile clients hold more than one tunnel open at the same time — each session with its own SIIT prefix, so traffic for each endpoint keeps its own address space.

Explore the docs

  • Architecture — server, API, desktop, and mobile components and how they interact
  • Post-Quantum Cryptography — ML-DSA-87 challenge-response authentication and ML-KEM-1024 key exchange
  • Tunneling — WireGuard as the transport, keyed from an authenticated exchange
  • Address Translation (SIIT) — stateless IPv4/IPv6 translation inside the tunnel
  • Installation — set up the server, desktop, and mobile clients
  • Configuration — server and client configuration reference
  • API — management API and protocol reference
  • Security — threat model and how to report a vulnerability
  • FAQ — frequently asked questions