Technology
We design the protocol. We do not design the cryptography.
The tunnel is built from primitives that have been picked over for years, assembled the way the Noise framework says to assemble them. What is ours is the part around it: how a connection proves it is allowed, and how the services are kept from learning what they do not need.
The handshake
A connection starts with a one-round-trip Noise IK handshake: Curve25519 for key agreement, ChaCha20-Poly1305 for the cipher, BLAKE2s for the hash. One packet out, one packet back, and the tunnel is up — typically in a few milliseconds plus the round trip.
The IK pattern means your device already knows the gateway’s public key (the directory gave it) and encrypts its own key to it in the first message. A passive observer sees a handshake but not which device is connecting.
Transport keys are replaced every 120 seconds, on the same socket, without dropping the session; the old keys keep decrypting for one second so a packet in flight is not lost. Each packet carries a 64-bit counter that is never reused, and the receiver keeps a 2048-entry sliding window so a replayed packet is dropped after authentication rather than before.
ChaCha20 rather than AES because it runs in constant time in software on every device, including the ones without hardware AES.
The credential: 89 bytes, no name
To connect, the app shows the gateway a signed credential. The gateway checks the signature against a small set of public keys it already holds, checks the dates, and lets the session through. It does this on its own: nothing about your account is consulted on the connection path.
What is in the credential is on the right. What is not in it is the point. There is no account identifier, no device identifier, no email, no name. Not redacted or hashed — there is no field. The gateway cannot log who connected because it was never told.
Credentials are short-lived (12 hours by default, 24 at most), so revocation is expiry. The part of the system that signs them is told only the tier, never the account.
The part that knows your name never carries your traffic
And the part that carries your traffic is never told your name. That is a property of how the pieces are wired, not a rule about who may look where.
An established tunnel does not depend on sign-in.
The servers that carry traffic hold what they need to keep a session going. If everything behind them goes dark, the tunnels stay up; what stops is starting a new one.
Nothing pushes to the traffic servers.
They fetch the few things they need on a timer and report a session count. They receive no account events, because there is nothing about an account for them to receive.
Who connected where is not a record anywhere.
Billing and device changes are events. A connection is not one; no component produces it.
The keys that sign credentials are held apart.
A compromise of the part that holds emails does not yield the power to mint credentials.
Resisting floods
A handshake costs the gateway a Curve25519 operation, and an attacker can send handshake messages all day. So every handshake message carries a MAC keyed on the gateway’s public key. Checking it takes about 500 nanoseconds; the key exchange it guards takes about 250 microseconds. Anyone who does not know the key is rejected before any real work, and a port scanner gets silence.
Under load — more than a hundred initiations a second — the gateway starts handing out cookies: small encrypted tokens bound to the sender’s address, rotated every two minutes, required on the next attempt. The cookie reply is smaller than the message that triggered it, so the gateway cannot be used to amplify an attack on somebody else.
On the roadmap
What comes next for the protocol, in the order we think it matters.
- Obfuscation. The protocol does not yet disguise itself as other traffic, so a network that blocks VPN protocols can block it. An obfuscated transport is planned.
- Post-quantum key exchange. A hybrid of Curve25519 and a post-quantum KEM, so a recording made today cannot be opened by a machine built later.
- Unlinkable credentials. The credential already carries no account. Blind-signed tokens would mean sign-in cannot even tell which credential it issued to whom; the version byte is reserved for them.
- Independent review. When it is published, it will be linked here.