Want to be notified of new releases in warner/wireguard-vanity-address?
Generate Wireguard keypairs with a given prefix string.
The Wireguard VPN uses Curve25519 keypairs, and displays the Base64-encoded public key in status displays. I found it hard to remember which key goes with which target, and the config file doesn't really support comments or attaching human-memorable names to those keys.
So this tool lets you generate a few million keypairs and print out just the ones with a given string in the first few (10) letters, using a case-insensitive search to increase your chances.
The tool will run for a long time, printing out more and more candidates as it goes, so just interrupt the process with Control-C or SIGINT when you've seen something that you like. There is no saved state or config file, and the generation process is entirely memoryless, so you don't lose any progress by interrupting it.
Once you've found a key that you like, copy the private half (on the left) into your wg0.conf config file as the [Interface] PrivateKey= field, and use the public half (on the right) on the other side of that VPN connection in a [Peer] PublicKey= entry.
On my 2017 laptop (quad-core 2.8GHz), this tool checks about 60 thousand keys per second per core. It uses rayon to parallelize across all available cores, achieving 240k keys per second.
Only a tiny fraction of those trial keys will match the search string. Each character of the target string reduces this fraction by a factor of about 32 (case-folded base64 encoding). By allowing the match to occur anywhere in the first ten letters, we increase the hit rate by about 10x.
A four-character string like dave means only one out of every (roughly) 100k keys will match, while a five-character string like carol reduces that to one out of 3.3 million. Longer strings will yield fewer candidate keypairs for a given amount of runtime.
You can run this on multiple machines, but of course you then risk revealing your private VPN key to any of those machines. There is no support for managing clusters or anything like that: just install the tool on each worker machine and run it with the same argument.
Since Wireguard VPN keys are not really public identifiers (you wouldn't publish them on a web page as you might with Tor's "Onion Addresses", or Bitcoin addresses), my advice is to stick with a four or five character search string, and don't try too hard to find a perfect pubkey. You only need something distinctive enough distinguish between a handful of VPN targets in a status display.
This is distributed under the MIT license, see LICENSE for details.