Debian Bug report logs - #1118522
RFP: rosenpass -- post-quantum-secure VPN that uses WireGuard to transport the actual data

Package: wnpp; Maintainer for wnpp is wnpp@debian.org;

Affects: src:rosenpass

Reported by: Georg Faerber <georg@debian.org>

Date: Tue, 21 Oct 2025 14:52:01 UTC

Severity: wishlist

Reply or subscribe to this bug.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, debian-devel@lists.debian.org (additional cc recipient for {1118522}), Georg Faerber <georg@debian.org> (owner of 1118522 for {1118522}), wnpp@debian.org (wnpp for {1118522}):
Bug#1118522; Package wnpp. (Tue, 21 Oct 2025 14:52:02 GMT) (full text, mbox, link).


Acknowledgement sent to Georg Faerber <georg@debian.org>:
New Bug report received and forwarded. Copy sent to debian-devel@lists.debian.org, wnpp@debian.org. (Tue, 21 Oct 2025 14:52:02 GMT) (full text, mbox, link).


Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Georg Faerber <georg@debian.org>
To: submit@bugs.debian.org
Subject: RFP: rosenpass -- post-quantum-secure VPN that uses WireGuard to transport the actual data
Date: Tue, 21 Oct 2025 14:50:23 +0000
Package: wnpp
Owner: Georg Faerber <georg@debian.org>
Severity: wishlist
X-Debbugs-Cc: debian-devel@lists.debian.org

Package name    : rosenpass
Version         : 0.2.2
Upstream Author : Rosenpass cryptography research group and contributors
URL             : https://github.com/rosenpass/rosenpass
License         : Apache Software License (ASL) 2.0 and MIT
Programming Lang: Rust
Description     : post-quantum-secure VPN that uses WireGuard to transport the actual data

Rosenpass is a key-exchange protocol using techniques that are secure
against attacks from quantum computers. It achieves the same security
guarantees as WireGuard, using two strong post-quantum key exchange
methods – Classic McEliece and Kyber.

Rosenpass keeps WireGuard security intact and adds on to it; Rosenpass
handles post-quantum security, WireGuard handles pre-quantum security.



Information forwarded to debian-bugs-dist@lists.debian.org, Georg Faerber <georg@debian.org> (owner of 1118522 for {1118522}), wnpp@debian.org (wnpp for {1118522}):
Bug#1118522; Package wnpp. (Wed, 22 Oct 2025 02:47:01 GMT) (full text, mbox, link).


Acknowledgement sent to Yifei Zhan <yifei@zhan.science>:
Extra info received and forwarded to list. Copy sent to wnpp@debian.org. (Wed, 22 Oct 2025 02:47:01 GMT) (full text, mbox, link).


Message #10 received at 1118522@bugs.debian.org (full text, mbox, reply):

From: Yifei Zhan <yifei@zhan.science>
To: Georg Faerber <georg@debian.org>
Cc: 1118522@bugs.debian.org
Subject: Re: Bug#1118522: RFP: rosenpass -- post-quantum-secure VPN that uses WireGuard to transport the actual data
Date: Wed, 22 Oct 2025 02:36:24 +0000
[Message part 1 (text/plain, inline)]
On Tuesday, October 21, 2025 2:50:23 PM Coordinated Universal Time Georg 
Faerber wrote:
> Package: wnpp
> Owner: Georg Faerber <georg@debian.org>
> Severity: wishlist
> X-Debbugs-Cc: debian-devel@lists.debian.org
> 
> Package name    : rosenpass
> Version         : 0.2.2
> Upstream Author : Rosenpass cryptography research group and contributors
> URL             : https://github.com/rosenpass/rosenpass
> License         : Apache Software License (ASL) 2.0 and MIT
> Programming Lang: Rust
> Description     : post-quantum-secure VPN that uses WireGuard to transport
> the actual data
> 
> Rosenpass is a key-exchange protocol using techniques that are secure
> against attacks from quantum computers. It achieves the same security
> guarantees as WireGuard, using two strong post-quantum key exchange
> methods – Classic McEliece and Kyber.
> 
> Rosenpass keeps WireGuard security intact and adds on to it; Rosenpass
> handles post-quantum security, WireGuard handles pre-quantum security.

Rosenpass depends on quite a few crates [0], I would suggest packaging 
individual crates Rosenpass depends on according to the rust team book [1] and 
then package the Rosenpass workspaces as a whole [2].

Good luck!

[0] debstatus output on the rosenpass repository, at the time of writing, 
might not be fully correct or complete:
https://salsa.debian.org/uploads/-/system/user/17093/
dd261dde0d9aa122c80fb736b4423681/rosenpass.debstatus
[1]: https://rust-team.pages.debian.net/book/process-single.html
[2]: https://rust-team.pages.debian.net/book/process-workspace.html
[signature.asc (application/pgp-signature, inline)]

Removed annotation that Bug was owned by Georg Faerber <georg@debian.org>. Request was from bartm@debian.org to control@bugs.debian.org. (Wed, 22 Oct 2025 02:53:02 GMT) (full text, mbox, link).


Added indication that 1118522 affects src:rosenpass Request was from Chris Hofstaedtler <zeha@debian.org> to control@bugs.debian.org. (Sat, 29 Nov 2025 16:59:39 GMT) (full text, mbox, link).


Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Dec 20 03:01:49 2025; Machine Name: berlioz

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.