Native, hardware-accelerated WireGuard implementation for Cortex-M33 (STM32H5)
This repository contains the public API headers and documentation for the commercial PNFD WireGuard Stack.
Integrating a full WireGuard VPN directly on a microcontroller (without a Linux Gateway) is hard. Integrating it with Azure RTOS (NetX Duo) and hardware cryptography while preparing for the Cyber Resilience Act (CRA) is even harder.
We did the heavy lifting for you.
This repository showcases the API (wireguardif_netx.h) of our drop-in commercial solution. It is designed to save you 3-4 months of R&D and certification headaches.
👉 Watch the Live Demo & Get the Binary here 👈
By fully utilizing the STM32H5 SAES and PKA engines, we achieve handshake times of < 200ms.
| Chip / MCU | Mode | Performance | Device Purpose |
|---|---|---|---|
| STM32 H563 | Encryption only | 61.29 MBit/s | Production part |
| STM32 H573 | NetX Duo + ThreadX Threads | 8.92 MBit/s | Demonstrator |
Take a look at the provided wireguardif_netx.h to see how easily the stack integrates into your existing NetX Duo project.
- Zero-Copy Architecture: Operates directly on
NX_PACKETpools. - Connection-less UDP: Perfect for unstable LTE/4G environments.
- TrustZone Ready: Designed to keep the private keys isolated.
Q: WireGuard uses a timestamp to prevent replay attacks. How do I provide the time if I only have UDP packets?
A: While the connection may function as long as the device doesn't reboot, we strongly recommend using SNTP or an RTC. If the device reboots without the correct time, the connection will be denied until its internal timestamp exceeds the previous one. Use our API wireguardif_set_sntp_time() to sync.
Q: What is the best way to handle private key storage in production?
A: For devices without a dedicated Secure Element, we use a reserved flash section. On first boot, generate a curve25519 pair, encrypt the private key using the MCU's unique hardware ID (UUID), and persist it. At runtime, the application decrypts it and passes it to wireguardif_init().
This is a commercial product offering a royalty-free license for your end devices.
What you get when purchasing the stack:
- Full C Source Code & CMake/STM32CubeIDE Integration
- Pre-configured Azure RTOS Project (STM32H5)
- Integration Support directly by the developer
📩 Contact: contact@pnfd.de | 🌐 Website: www.pnfd.de/wireguard.html
WireGuard is a registered trademark of Jason A. Donenfeld.