Introduction to QuFabric

QuFabric is a security-hardened Zero Trust Networking platform purpose-built for transmitting classified and top-secret data over the public internet. It creates encrypted point-to-point overlay networks that meet the stringent requirements of government, defence, and critical infrastructure environments.

QuFabric is built on NetBird, an open-source Zero Trust Networking platform. We extend NetBird with additional security layers specifically designed for environments that handle sensitive and classified information, aligning with the NSA's Commercial Solutions for Classified (CSfC) program requirements.

What Makes QuFabric Different

QuFabric adds critical security capabilities on top of NetBird's Zero Trust architecture:

• Double VPN with Independent Encryption — Two nested WireGuard tunnels: an outer tunnel (wg0) using ChaCha20-Poly1305 with post-quantum key exchange via Rosenpass (enabled by default), and an inner tunnel (aes0) using AES-256-GCM with DSKE-managed keys. This dual-layer architecture aligns with CSfC requirements.
• Post-Quantum Cryptography — The outer tunnel runs Rosenpass by default, continuously rotating pre-shared keys using quantum-resistant algorithms (Classic McEliece + Kyber) to protect against "harvest now, decrypt later" attacks.
• Distributed Symmetric Key Exchange (DSKE) — Automated management of pre-shared keys for the inner AES tunnel, using threshold cryptography across multiple security hubs to eliminate reliance on Diffie-Hellman key exchange alone.
• Dual-Interface Access Control — Firewall rules enforced across both wg0 and aes0 interfaces, ensuring consistent security policy regardless of which encryption tunnel carries the traffic.

Like NetBird, QuFabric requires no centralized VPN server — your machines connect directly over fast encrypted tunnels. It creates a high-performance point-to-point WireGuard® overlay network that connects machines running anywhere.