Technology
We design the protocol. We do not design the cryptography.
The tunnel is built from primitives that have been picked over for years, assembled the way the Noise framework says to assemble them. What is ours is the part around it: how a connection proves it is allowed, and how the services are kept from learning what they do not need.
The handshake
A connection starts with a one-round-trip Noise IK handshake: Curve25519 for key agreement, ChaCha20-Poly1305 for the cipher, BLAKE2s for the hash. One packet out, one packet back, and the tunnel is up — typically in a few milliseconds plus the round trip.
The IK pattern means your device already knows the gateway’s public key (the directory gave it) and encrypts its own key to it in the first message. A passive observer sees a handshake but not which device is connecting.
Transport keys are replaced every 120 seconds, on the same socket, without dropping the session; the old keys keep decrypting for one second so a packet in flight is not lost. Each packet carries a 64-bit counter that is never reused, and the receiver keeps a 2048-entry sliding window so a replayed packet is dropped after authentication rather than before.
ChaCha20 rather than AES because it runs in constant time in software on every device, including the ones without hardware AES.
The credential: 89 bytes, no name
To connect, the app shows the gateway a signed credential. The gateway checks the signature against a small set of public keys it already holds, checks the dates, and lets the session through. It does this on its own: nothing about your account is consulted on the connection path.
What is in the credential is on the right. What is not in it is the point. There is no account identifier, no device identifier, no email, no name. Not redacted or hashed — there is no field. The gateway cannot log who connected because it was never told.
Credentials are short-lived (12 hours by default, 24 at most), so revocation is expiry. The part of the system that signs them is told only the tier, never the account.
The part that knows your name never carries your traffic
And the part that carries your traffic is never told your name. That is a property of how the pieces are wired, not a rule about who may look where.
An established tunnel does not depend on sign-in.
The servers that carry traffic hold what they need to keep a session going. If everything behind them goes dark, the tunnels stay up; what stops is starting a new one.
Nothing pushes to the traffic servers.
They fetch the few things they need on a timer and report a session count. They receive no account events, because there is nothing about an account for them to receive.
Who connected where is not a record anywhere.
Billing and device changes are events. A connection is not one; no component produces it.
The keys that sign credentials are held apart.
A compromise of the part that holds emails does not yield the power to mint credentials.
Resisting floods
A handshake costs the gateway a Curve25519 operation, and an attacker can send handshake messages all day. So every handshake message carries a MAC keyed on the gateway’s public key. Checking it takes about 500 nanoseconds; the key exchange it guards takes about 250 microseconds. Anyone who does not know the key is rejected before any real work, and a port scanner gets silence.
Under load — more than a hundred initiations a second — the gateway starts handing out cookies: small encrypted tokens bound to the sender’s address, rotated every two minutes, required on the next attempt. The cookie reply is smaller than the message that triggered it, so the gateway cannot be used to amplify an attack on somebody else.
Stated plainly, because a mitigation that is oversold is worse than one that is understood: this protects the gateway’s CPU, not its bandwidth. A volumetric flood needs upstream scrubbing like any other server’s.
On the roadmap
The protocol is at version 1. What comes next, in the order we think it matters.
- Traffic-analysis resistance. Packets are not padded and the protocol does not try to look like anything else. A network that wants to block it can.
- Post-quantum key exchange. Curve25519 only. A hybrid is on the list; it is not in the code.
- Handshake-initiation replay. A captured first message can be replayed to trigger a handshake computation. A timestamp check is specified and not implemented.
- Unlinkable credentials. The credential carries no account, but sign-in knows when one was issued to you. Blind-signed tokens would close that; the version byte is reserved for them.
- Independent review. Not yet; when there is one, it will be linked here.