Surfshark's new protocol achieves record-breaking speeds in consumer VPNs

Fully post-quantum secure Surfshark Dausos is 30% faster than other industry-standard protocols.

Surfshark, a leading VPN provider, is revolutionizing the consumer VPN industry with the launch of its own VPN protocol, Dausos. While traditional VPNs consolidate all user traffic through a single digital tunnel (TUN network interface), Dausos is the first protocol engineered to give each user their own dedicated, private data tunnel. This allows improving speeds up to 30% than the current fastest VPN protocols, while also providing enhanced security and privacy.

“With this new protocol, we elevate three key elements that are essential for a VPN user. Dausos allows achieving 30% higher speeds compared to existing fastest protocols, enhances security with a fully quantum-secure cryptographical encryption, and configures a dedicated tunnel for data traffic automatically ensuring smooth, uninterrupted connectivity,” explains Karolis Kaciulis, Leading System Engineer at Surfshark.

What makes Surfshark Dausos unique?

Dausos' innovation lies in its ability to provide a dedicated tunnel for each user session and dynamically adapt to network conditions and device capabilities by intelligently distributing user data packets. This ensures optimized performance tailored to the user's specific network configuration.

“A key security aspect of this protocol is the isolation of user data traffic. While the risk of cross-traffic exposure in modern VPNs is very low, our unique protocol design goes the extra mile to ensure a clean, private, and secure path for each user's data. Furthermore, the protocol's unique design avoids unnecessary and redundant checking of data packets, which enhances connection performance and even further prevents the theoretical possibility of data packets interfering with each other,” explains Kaciulis.

Full post-quantum security

While improving the VPN performance was important, the engineering team focused a lot on further enhancing users’ security and future-proofing it for the quantum era.

“We introduced numerous steps, some of them never seen in any VPN protocol before, to maximize the security of our protocol. For example, for this protocol, Surfshark created their own self-signed root certificate authority issuing system with the ML-DSA signature scheme that is the new standard in post-quantum security for signing and verifying communication channels. Think of root certificates as digital files used by your device to verify that the websites, software, and connections you use are actually who they say they are. As the world is moving rapidly towards post-quantum times, providers will soon have to adopt post-quantum secure certificate schemes. We wanted to be at the forefront and adopt this technology as soon as possible, and our own protocol seemed like the best opportunity for that,” says Kaciulis.

Dausos also uses a hybrid post-quantum secure key exchange ML-KEM*X25519 (X25519MLKEM768). It combines a trusted, modern standard (X25519) with a brand-new, NIST-approved defense (ML-KEM) to create a secure connection. By using this hybrid approach, Surfshark ensures your data is protected against both today's hackers and future quantum computers.

Beyond current security standards

Surfshark’s new protocol also employs session control with post-compromise security. For every new session and with every re-keying instance, Dausos protocol generates new key pairs without any relation to the previous sessions or key iterations. This ensures that if one key is lost, no other keys could be derived from it. This secures future communication, even if the current session key is compromised. This is a step forward from the traditional Perfect Forward Secrecy (PFS) approach. “PFS is essential in any kind of secure communication – it ensures that if a session encryption key gets leaked, only a small part of the session can get decrypted (e.g., last 5 minutes). However, when building Dausos, we wanted to go another step forward, introducing post-compromise security.”

An additional security measure in Dausos is port randomization. “Normally, many VPN protocols use a fixed port (like a specific gate at an airport) for every connection. However, with Dausos, every session is connected via a randomized port address to a server, like changing your gate every time you fly. This adds yet another security layer to our users.”

Dausos protocol also uses the modern, high-speed AEGIS-256X2 cryptographic algorithm, ensuring secure, authenticated encryption and improving the protocol's overall performance.

According to Kaciulis, Dausos uses AEGIS encryption because its capabilities allow a significant advancement in VPN technology.

“It's a step forward to future advancements. AEGIS delivers high-quality authenticated encryption, guaranteeing both efficiency and high performance. This, combined with enhanced speeds, allows us to advance current VPN technology and offer users a faster, more secure VPN experience."

Audited and patented for the user’s security

Surfshark Dausos was audited by Cure53, a Berlin-based IT security consulting firm. They conducted a penetration test and source code audit on the Surfshark VPN Dausos protocol, with a specific focus on the connected architecture and cryptography. The audit results reflect a stable and resilient platform, and no findings were rated at Critical or High severity within the protocol.

In addition, Surfshark has filed a patent application for its unique protocol architecture.

The newly launched protocol is now available for macOS users and will be coming soon to other platforms.