Jason A. Donenfeld is the 32-year-old creator ofWireGuard , an open-sourceVPN protocol widely seen as one of the most secure in the world.- In 2020, it found mainstream success and was adopted into the popular
Linux kernel, as well as on Windows, Mac, iOS, and Android operating systems. - Donenfeld started the project in 2015, and spent years building an open-source community to support WireGuard.
- He spoke with Business Insider about his path to creating WireGuard, how he sees VPN security, and the overwhelming response the project, which is funded entirely by donations, has gotten from developers.
Jason A. Donenfeld is relentlessly curious about everything, from ancient cities to cutting edge cryptography. When he's not developing WireGuard, known as the most secure VPN protocol in the world, the security researcher enjoys exploring the vast network of centuries-old limestone tunnels beneath Paris.
Donenfeld, who is 32, originally came to Paris in 2010, after landing a summer gig writing shape packing algorithms, and then moved to the city fully in 2012, working as a vulnerability researcher.
His work finding vulnerabilities for companies led him to doubt the security of popular VPN protocols. He thought the dizzying complexity, bloated implementations, and often outdated cryptography made for a worrisome attack surface. In 2015, he started developing WireGuard.
WireGuard is an open-source VPN protocol that's been lauded for its high-level security. In the few short years that Donenfeld has developed it, WireGuard has been adopted by the major operating system Linux, and integrated into Mac and Windows, as well as iOS, Android, and others.
Virtual private networks, or VPNs, extend private networks across public ones, allowing data centers across continents to connect directly to one another. They also let users send and receive data as if their computers or phones are directly connected to private networks.
This can sometimes be misleading. Even though companies and individuals alike may believe they're connecting securely over a VPN, this isn't always the case, in part due to the difficulty of implementing outdated, complex, or insecure protocols like IPSec and OpenVPN.
"When I say I don't feel comfortable with OpenVPN or IPSec implementations, it's speaking from experience, because I've found a lot of bugs in that kind of software," he said.
He said that his time spent breaking into systems left him with the knowledge on how to defend them, too.
"How you evade detection on a network can be a very similar problem as how you keep attackers from knowing about your box," he said.
Part of WireGuard's appeal is in how it maintains security through a few distinct ways, eliminating entire classes of vulnerabilities. It's high-speed. It utilizes defense-in-depth techniques, a series of layered mechanisms to protect data and information. And it's stealthy, only transmitting data when necessary and staying invisible when people scan for its servers.
Plus, it's easier to audit. Unlike other VPN protocols, WireGuard has less than 4,000 lines of code, which means that security researchers could review the entire codebase for vulnerabilities in a single afternoon. And they often do.
'It's a community project'
This past year, WireGuard was merged into the influential Linux kernel, which led to widespread adoption on Windows, macOS, iOS, Android, and OpenBSD, in addition to Linux distributions such as Canonical's Ubuntu, Debian, Oracle Linux, Red Hat's CentOS and Fedora, and SUSE Linux.
Getting there wasn't easy. Donenfeld wanted to have a single, coherent design where he could make every decision carefully, scrutinizing every piece. So he spent time developing WireGuard himself before it was released, he said, only sharing code with a couple of friends and cryptographers.
"He first contacted me out of the blue when he was developing WireGuard and he had crafted some cryptographic protocol and he wanted my review of it. I proposed little changes, but what he did initially was already very good," said Jean-Philippe Aumasson, a cryptographer, author, and co-founder of the security company Taurus Group SA.
But Donenfeld wanted to completely change something as fundamental as Linux's cryptography architecture, and he was met with some resistance. Linux is tremendously popular, so sweeping changes could be disruptive. In order to get where he wanted, he had to start small, with incremental changes, and engage with other people's ideas and get them on board.
"This is how kernel development is done in general - it's a community project; you have to reach consensus," he said. "There's a big difference between releasing open source code and saying, 'here you go,' and disappearing back to a cave, and actually interacting with that world. I've chosen to interact really intimately with it, and that's meant lots of interaction and figuring out how each facet works."
The process involved working with other developers and researchers, and giving talks at conferences, including Kernel Recipes at Mozilla's headquarters in Paris to connect with the developer community while building WireGuard.
"I didn't want to compromise on the security of the intermediate parts. I didn't want to make WireGuard depend on something with subpar security while I promised to fix it up 'later.' That's never acceptable to me. So finding something that was both evolutionary so that it would be merged but also still lived up to the security ideals was a very difficult process," he said.
Donenfeld also wrote a compatibility layer for WireGuard, so people could load the code into their own kernels - the lowest depths of an operating system - before it was sent upstream. This involved the formidable task of writing kernel code that was compatible with variants and versions of Linux going back to 2013. But it meant that by the time Donenfeld was ready to upstream WireGuard, people were already using it.
The Exchange of Ideas
Donenfeld's background is not the norm in the industry, but his intense curiosity and his drive may have worked in his favor.
"There's a really well-defined pipeline that gets people to professional cryptography jobs and to status in the cryptography community," Thomas Ptacek, a security researcher and principal at Fly.io, said. "It typically involves getting a degree, followed by a graduate degree from a program run by an extremely well-known cryptographer, and then working in a research lab for a long time right out of university."
In contrast, Donenfeld graduated with a degree in mathematics and philosophy from Columbia University in New York after growing up in Cincinnati. While his background is atypical, Donenfeld has still managed to produce the first formally verified VPN protocol, which means that it's been mathematically proven to be secure.
Donenfeld works on WireGuard mostly from his home, the top floor of an apartment building that appears to have been converted from several chambres de bonne - single rooms once intended for maids - thrown together. Before the pandemic, he used to work from different rooftops and cafes all over Paris, bringing his Linux laptop with him as he explored the city.
When he's not coding, Donenfeld is part of the Paris jazz scene. He rocks a D'Angelico NYSS-3 guitar and has played around town at clubs like Le Caveau des Oubliettes. Lately, he says, he's been listening to a lot of John Coltrane and Bill Frisell.
WireGuard is also financed entirely by donations, atypical in the software industry. In appreciation to donors, Donenfeld said he has mailed out thousands of stickers with WireGuard's logo, which was inspired by a stone engraving of the mythological ancient Greek python that he saw while visiting a museum in Delphi.
It's only been a few years, but Donenfeld said he had received enough in donations to work on WireGuard full-time and to fund other developers working on specific aspects of it, but he said the project is always trying to make it for another year.
"I've received job offers from Silicon Valley companies that would definitely result in a more financially rewarding life than being an open source author," he said.
If he ever finds that he doesn't have the funding to work on improving WireGuard, he can always fall back to freelance jobs in the security industry instead.
Donenfeld's goal is to continue developing high-quality, professional, free, open source software from which the entire community can benefit.
"Open sourcing something and interacting with that community is really just a great way to improve software, and it makes for a great exchange of ideas," he said.