Identity Is a Key, Not a Username
In most VPN systems, authentication and routing are separate concerns. You prove who you are (username, password, certificate), the server decides to let you in, and then assigns you an IP address from a pool. The IP you get is somewhat arbitrary — it's just a label the server chose for you.
WireGuard collapses these two concerns into a single concept called Cryptokey Routing. Your identity is your cryptographic key, and your key is permanently bound to one or more IP addresses. There is no separate authentication step. There is no IP address pool. The mapping is static and explicit.
The Routing Table
Every WireGuard interface maintains an internal peer table. Each row looks like this:
| Field | Example Value | Purpose |
|---|---|---|
| Peer Public Key | TrMv...5kX= |
Identifies who this peer is |
| Allowed IPs | 10.10.0.5/32 |
IPs this peer is authorized to use |
| Endpoint | 203.0.113.8:51820 |
Where to send encrypted packets for this peer |
| Latest Handshake | 2 minutes ago |
Last time a session was established |
This table drives two distinct operations:
Sending (Outbound Encryption):
When the kernel wants to send a packet to 10.10.0.5, WireGuard scans the peer table for a matching AllowedIPs entry. It finds the row above, encrypts the packet using that peer's public key, and sends the encrypted UDP datagram to 203.0.113.8:51820. The original packet is now invisible inside an encrypted envelope.
Receiving (Inbound Decryption and Verification):
When an encrypted UDP packet arrives on port 51820, WireGuard decrypts it using the session key derived from the peer's public key. Decryption succeeding proves the sender holds the correct private key. But WireGuard doesn't stop there — it performs a second check: "Does the decrypted packet's source IP appear in the AllowedIPs list for this peer?"
- If Yes: The packet is accepted and injected into the network stack.
- If No: The packet is dropped silently, with no error response.
This two-step verification is what makes Cryptokey Routing powerful. An attacker cannot forge a packet claiming to be from 10.10.0.5 unless they possess the private key that corresponds to the public key mapped to that IP. Cryptographic identity and network identity are the same thing.
The architectural implication for senior engineers: Cryptokey Routing means WireGuard has no concept of a "connected" or "authenticated" session in the traditional sense. There is no login event, no session token, no state to hijack. Access control is enforced purely by whether you can produce valid ciphertext for a given key — and whether the plaintext inside claims an IP you're authorized to use. Revoking access means removing the peer's public key from the configuration. The change takes effect immediately for the next packet.