Sanctum is a small, reviewable, capable, PQ-secure and fully privilege separated VPN daemon for OpenBSD, Linux and MacOS. It is designed from the ground up with security in mind and will always be open and free, licensed under the ISC license.
Sanctum uses strong cryptography and a unique hybridized key exchange that combines symmetrical keying with classical and PQ-secure asymmetry. See docs/crypto.md for a detailed description of the cryptosystem in sanctum.
It allows the creation of different topologies from traditional site-to-site or client-to-site tunnels, to one-way tunnels or p2p e2ee secure links between devices, even when behind NAT.
Sanctum is often used to create more secure replacements for things like Tailscale or Zerotier.
A community driven sanctum cathedral network can be found at The Reliquary.
See docs/building.md for building instructions.
Please send your git patches to priests@sanctorum.se.
See share/example.conf for a simple example configuration.
For more hands on examples, see the different guides below:
You can use libkyrka to implement the sanctum protocol and p2p e2ee tunnels into your application directly.