Updated documentation

This commit is contained in:
Mark Qvist 2022-08-25 11:00:30 +02:00
parent 6a53298aa2
commit 6db742ade7
16 changed files with 157 additions and 107 deletions

Binary file not shown.

View File

@ -16,7 +16,7 @@ over even extremely low-bandwidth Reticulum networks.
These programs will let you get a feel for how Reticulum works. They have been designed These programs will let you get a feel for how Reticulum works. They have been designed
to run well over networks based on LoRa or packet radio, but can also be used completely to run well over networks based on LoRa or packet radio, but can also be used completely
over local WiFi, wired ethernet, the Internet, or any combination. over local WiFi, wired Ethernet, the Internet, or any combination.
As such, it is easy to get started experimenting, without having to set up any radio As such, it is easy to get started experimenting, without having to set up any radio
transceivers or infrastructure just to try it out. Launching the programs on separate transceivers or infrastructure just to try it out. Launching the programs on separate
@ -91,7 +91,7 @@ or use the interactive ``rnsconfig`` utility.
When Reticulum is started for the first time, it will create a default When Reticulum is started for the first time, it will create a default
configuration file, with one active interface. This default interface uses configuration file, with one active interface. This default interface uses
your existing ethernet and WiFi networks (if any), and only allows you to your existing Ethernet and WiFi networks (if any), and only allows you to
communicate with other Reticulum peers within your local broadcast domains. communicate with other Reticulum peers within your local broadcast domains.
To communicate further, you will have to add one or more interfaces. The default To communicate further, you will have to add one or more interfaces. The default
@ -106,7 +106,7 @@ Once Reticulum knows which interfaces it should use, it will automatically
discover topography and configure transport of data to any destinations it discover topography and configure transport of data to any destinations it
knows about. knows about.
In situations where you already have an established WiFi or ethernet network, and In situations where you already have an established WiFi or Ethernet network, and
many devices that want to utilise the same external Reticulum network paths (for example over many devices that want to utilise the same external Reticulum network paths (for example over
LoRa), it will often be sufficient to let one system act as a Reticulum gateway, by LoRa), it will often be sufficient to let one system act as a Reticulum gateway, by
adding any external interfaces to the configuration of this system, and then enabling transport on it. Any adding any external interfaces to the configuration of this system, and then enabling transport on it. Any
@ -131,7 +131,7 @@ TCP connections reveal the IP address of both your instance and the server to an
inspect the connection. Someone could use this information to determine your location or identity. Adversaries inspect the connection. Someone could use this information to determine your location or identity. Adversaries
inspecting your packets may be able to record packet metadata like time of transmission and packet size. inspecting your packets may be able to record packet metadata like time of transmission and packet size.
Even though Reticulum encrypts traffic, TCP does not, so an adversary may be able to use Even though Reticulum encrypts traffic, TCP does not, so an adversary may be able to use
packet inspection to learn that a system is running Reticulum, and what other IP adresses connect to it. packet inspection to learn that a system is running Reticulum, and what other IP addresses connect to it.
Hosting a publicly reachable instance over TCP also requires a publicly reachable IP address, Hosting a publicly reachable instance over TCP also requires a publicly reachable IP address,
which most Internet connections don't offer anymore. which most Internet connections don't offer anymore.
@ -145,9 +145,9 @@ will also relay other I2P user's encrypted packets, which will use extra
bandwidth and compute power, but also makes timing attacks and other forms of bandwidth and compute power, but also makes timing attacks and other forms of
deep-packet-inspection much more difficult. deep-packet-inspection much more difficult.
I2P also allows users to host globally available Reticulum instances from non-public IPs and behind firewalls and NAT. I2P also allows users to host globally available Reticulum instances from non-public IP's and behind firewalls and NAT.
In general it is recommended to use an I2P node if you want to host a publically accessible In general it is recommended to use an I2P node if you want to host a publicly accessible
instance, while preserving anonymity. If you care more about performance, and a slightly instance, while preserving anonymity. If you care more about performance, and a slightly
easier setup, use TCP. easier setup, use TCP.
@ -367,4 +367,4 @@ All other available modules will still be loaded when needed.
**Please Note!** If you use the `rnspure` package to run Reticulum on systems that **Please Note!** If you use the `rnspure` package to run Reticulum on systems that
do not support `PyCA/cryptography <https://github.com/pyca/cryptography>`_, it is do not support `PyCA/cryptography <https://github.com/pyca/cryptography>`_, it is
important that you read and understand the :ref:`Cryptographic Primitives <understanding-primitives>` important that you read and understand the :ref:`Cryptographic Primitives <understanding-primitives>`
section of this manual. section of this manual.

View File

@ -52,7 +52,7 @@ the discussion to RNodes using *LoRa* modulation in common ISM bands.
**Avoid Confusion!** RNodes can use LoRa as a *physical-layer modulation*, but it **Avoid Confusion!** RNodes can use LoRa as a *physical-layer modulation*, but it
does not use, and has nothing to do with the *LoRaWAN* protocol and standard, commonly does not use, and has nothing to do with the *LoRaWAN* protocol and standard, commonly
used for centrally controlled IoT devices. RNodes use *raw LoRa modulation*, without used for centrally controlled IoT devices. RNodes use *raw LoRa modulation*, without
any additional protocol overhead. All high-level protocol funcionality is handled any additional protocol overhead. All high-level protocol functionality is handled
directly by Reticulum. directly by Reticulum.
.. _rnode-creating: .. _rnode-creating:
@ -205,8 +205,8 @@ get started with producing RNodes.
WiFi-based Hardware WiFi-based Hardware
=================== ===================
It is possible to use all kinds of both short- and long-range Wifi-based hardware It is possible to use all kinds of both short- and long-range WiFi-based hardware
with Reticulum. Any kind of hardware that fully supports bridged ethernet over the with Reticulum. Any kind of hardware that fully supports bridged Ethernet over the
WiFi interface will work with the :ref:`AutoInterface<interfaces-auto>` in Reticulum. WiFi interface will work with the :ref:`AutoInterface<interfaces-auto>` in Reticulum.
Most devices will behave like this by default, or allow it via configuration options. Most devices will behave like this by default, or allow it via configuration options.
@ -242,4 +242,4 @@ It is useful to combine different link and hardware types when designing and
building a network. One useful design pattern is to employ high-capacity point-to-point building a network. One useful design pattern is to employ high-capacity point-to-point
links based on WiFi or millimeter-wave radios (with high-gain directional antennas) links based on WiFi or millimeter-wave radios (with high-gain directional antennas)
for the network backbone, and using LoRa-based RNodes for covering large areas with for the network backbone, and using LoRa-based RNodes for covering large areas with
connectivity for client devices. connectivity for client devices.

View File

@ -98,13 +98,13 @@ and persistent I2P address that your Reticulum instance can be reached
at. at.
To use the I2P interface, you must have an I2P router running To use the I2P interface, you must have an I2P router running
on your system. The easiest way to acheive this is to download and on your system. The easiest way to achieve this is to download and
install the `latest release <https://github.com/PurpleI2P/i2pd/releases/latest>`_ install the `latest release <https://github.com/PurpleI2P/i2pd/releases/latest>`_
of the ``i2pd`` package. For more details about I2P, see the of the ``i2pd`` package. For more details about I2P, see the
`geti2p.net website <https://geti2p.net/en/about/intro>`_. `geti2p.net website <https://geti2p.net/en/about/intro>`_.
When an I2P router is running on your system, you can simply add When an I2P router is running on your system, you can simply add
an I2P interface to reticulum: an I2P interface to Reticulum:
.. code:: .. code::
@ -270,7 +270,7 @@ with all other peers on a local area network.
*Please Note!* Using broadcast UDP traffic has performance implications, *Please Note!* Using broadcast UDP traffic has performance implications,
especially on WiFi. If your goal is simply to enable easy communication especially on WiFi. If your goal is simply to enable easy communication
with all peers in your local ethernet broadcast domain, the with all peers in your local Ethernet broadcast domain, the
:ref:`Auto Interface<interfaces-auto>` performs better, and is even :ref:`Auto Interface<interfaces-auto>` performs better, and is even
easier to use. easier to use.
@ -404,7 +404,7 @@ directly over a wire-pair, or for using devices such as data radios and lasers.
Pipe Interface Pipe Interface
============== ==============
Using this interface, reticulum can use any program as an interface via `stdin` and Using this interface, Reticulum can use any program as an interface via `stdin` and
`stdout`. This can be used to easily create virtual interfaces, or to interface with `stdout`. This can be used to easily create virtual interfaces, or to interface with
custom hardware or other systems. custom hardware or other systems.
@ -421,7 +421,7 @@ custom hardware or other systems.
respawn_delay = 5 respawn_delay = 5
Reticulum will write all packets to `stdin` of the ``command`` option, and will Reticulum will write all packets to `stdin` of the ``command`` option, and will
continously read and scan its `stdout` for Reticulum packets. If ``EOF`` is reached, continuously read and scan its `stdout` for Reticulum packets. If ``EOF`` is reached,
Reticulum will try to respawn the program after waiting for ``respawn_interval`` seconds. Reticulum will try to respawn the program after waiting for ``respawn_interval`` seconds.
.. _interfaces-kiss: .. _interfaces-kiss:

View File

@ -9,7 +9,7 @@ Reticulum, which can often be easier than using traditional stacks, since you
don't have to worry about coordinating addresses, subnets and routing for an don't have to worry about coordinating addresses, subnets and routing for an
entire network that you might not know how will evolve in the future. With entire network that you might not know how will evolve in the future. With
Reticulum, you can simply add more segments to your network when it becomes Reticulum, you can simply add more segments to your network when it becomes
necesarry, and Reticulum will handle the convergence of the entire network necessary, and Reticulum will handle the convergence of the entire network
automatically. automatically.
Concepts & Overview Concepts & Overview
@ -18,13 +18,13 @@ Concepts & Overview
There are important points that need to be kept in mind when building networks There are important points that need to be kept in mind when building networks
with Reticulum: with Reticulum:
* | In a Reticulum network, any node can autonomously generate as many adresses * | In a Reticulum network, any node can autonomously generate as many addresses
(called *destinations* in Reticulum terminology) as it needs, which become (called *destinations* in Reticulum terminology) as it needs, which become
globally reachable to the rest of the network. There is no central point of globally reachable to the rest of the network. There is no central point of
control over the adress space. control over the address space.
* | Reticulum was designed to handle both very small, and very large networks. * | Reticulum was designed to handle both very small, and very large networks.
While the adress space can support billions of endpoints, Reticulum is While the address space can support billions of endpoints, Reticulum is
also very useful when just a few devices needs to communicate. also very useful when just a few devices needs to communicate.
* | Low-bandwidth networks, like LoRa and packet radio, can interoperate and * | Low-bandwidth networks, like LoRa and packet radio, can interoperate and
@ -113,8 +113,8 @@ WiFi based radios for interconnecting the sites.
At each site, a Raspberry Pi is installed to function as a gateway. A LoRa radio At each site, a Raspberry Pi is installed to function as a gateway. A LoRa radio
is connected to the Pi with a USB cable, and the WiFi radio is connected to the is connected to the Pi with a USB cable, and the WiFi radio is connected to the
ethernet port of the Pi. At site B, two WiFi radios are needed to be able to reach Ethernet port of the Pi. At site B, two WiFi radios are needed to be able to reach
both site A and site C, so an extra ethernet adapter is connected to the Pi in both site A and site C, so an extra Ethernet adapter is connected to the Pi in
this location. this location.
Once the hardware has been installed, Reticulum is installed on all the Pis, and at Once the hardware has been installed, Reticulum is installed on all the Pis, and at

View File

@ -32,11 +32,11 @@ Provide Feedback
================ ================
All feedback on the usage, functioning and potential dysfunctioning of any and All feedback on the usage, functioning and potential dysfunctioning of any and
all components of the system is very valuable to the continued development and all components of the system is very valuable to the continued development and
improvement of Reticulum. Absolutely no automated analytics, telemetly, error improvement of Reticulum. Absolutely no automated analytics, telemetry, error
reporting or statistics is collected and reported by Reticulum under any reporting or statistics is collected and reported by Reticulum under any
circumstances, so we rely on old-fashioned human feedback. circumstances, so we rely on old-fashioned human feedback.
Contribute Code Contribute Code
=============== ===============
Join us on `the GitHub repository <https://github.com/markqvist/reticulum>`_ to Join us on `the GitHub repository <https://github.com/markqvist/reticulum>`_ to
report issues, suggest functionality and contribute code to Reticulum. report issues, suggest functionality and contribute code to Reticulum.

View File

@ -70,7 +70,7 @@ guide the design of Reticulum:
* **Hardware layer agnosticism** * **Hardware layer agnosticism**
Reticulum must be fully hardware agnostic, and shall be useable over a wide range of Reticulum must be fully hardware agnostic, and shall be useable over a wide range of
physical networking layers, such as data radios, serial lines, modems, handheld transceivers, physical networking layers, such as data radios, serial lines, modems, handheld transceivers,
wired ethernet, wifi, or anything else that can carry a digital data stream. Hardware made for wired Ethernet, WiFi, or anything else that can carry a digital data stream. Hardware made for
dedicated Reticulum use shall be as cheap as possible and use off-the-shelf components, so dedicated Reticulum use shall be as cheap as possible and use off-the-shelf components, so
it can be easily modified and replicated by anyone interested in doing so. it can be easily modified and replicated by anyone interested in doing so.
* **Very low bandwidth requirements** * **Very low bandwidth requirements**
@ -109,7 +109,7 @@ Introduction & Basic Functionality
Reticulum is a networking stack suited for high-latency, low-bandwidth links. Reticulum is at its Reticulum is a networking stack suited for high-latency, low-bandwidth links. Reticulum is at its
core a *message oriented* system. It is suited for both local point-to-point or point-to-multipoint core a *message oriented* system. It is suited for both local point-to-point or point-to-multipoint
scenarios where alle nodes are within range of each other, as well as scenarios where packets need scenarios where all nodes are within range of each other, as well as scenarios where packets need
to be transported over multiple hops in a complex network to reach the recipient. to be transported over multiple hops in a complex network to reach the recipient.
Reticulum does away with the idea of addresses and ports known from IP, TCP and UDP. Instead Reticulum does away with the idea of addresses and ports known from IP, TCP and UDP. Instead
@ -121,14 +121,14 @@ All destinations in Reticulum are _represented_ as a 16 byte hash. This hash is
SHA-256 hash of identifying characteristics of the destination. To users, the destination addresses SHA-256 hash of identifying characteristics of the destination. To users, the destination addresses
will be displayed as 16 hexadecimal bytes, like this example: ``<13425ec15b621c1d928589718000d814>``. will be displayed as 16 hexadecimal bytes, like this example: ``<13425ec15b621c1d928589718000d814>``.
The truncation size of 16 bytes (128 bits) for destinations has been choosen as a reasonable tradeoff The truncation size of 16 bytes (128 bits) for destinations has been chosen as a reasonable trade-off
between address space between address space
and packet overhead. The address space accomodated by this size can support many billions of and packet overhead. The address space accommodated by this size can support many billions of
simultaneously active devices on the same network, while keeping packet overhead low, which is simultaneously active devices on the same network, while keeping packet overhead low, which is
essential on low-bandwidth networks. In the very unlikely case that this address space nears essential on low-bandwidth networks. In the very unlikely case that this address space nears
congestion, a one-line code change can upgrade the Reticulum address space all the way up to 256 congestion, a one-line code change can upgrade the Reticulum address space all the way up to 256
bits, ensuring the Reticulum address space could potentially support galactic-scale networks. bits, ensuring the Reticulum address space could potentially support galactic-scale networks.
This is obviusly complete and ridiculous over-allocation, and as such, the current 128 bits should This is obviously complete and ridiculous over-allocation, and as such, the current 128 bits should
be sufficient, even far into the future. be sufficient, even far into the future.
By default Reticulum encrypts all data using elliptic curve cryptography. Any packet sent to a By default Reticulum encrypts all data using elliptic curve cryptography. Any packet sent to a
@ -163,7 +163,7 @@ destinations. Reticulum uses three different basic destination types, and one sp
A *plain* destination type is unencrypted, and suited for traffic that should be broadcast to a A *plain* destination type is unencrypted, and suited for traffic that should be broadcast to a
number of users, or should be readable by anyone. Traffic to a *plain* destination is not encrypted. number of users, or should be readable by anyone. Traffic to a *plain* destination is not encrypted.
Generally, *plain* destinations can be used for broadcast information intended to be public. Generally, *plain* destinations can be used for broadcast information intended to be public.
Plain destinations are only reachable directly, and packets adressed to plain destinations are Plain destinations are only reachable directly, and packets addressed to plain destinations are
never transported over multiple hops in the network. To be transportable over multiple hops in Reticulum, information never transported over multiple hops in the network. To be transportable over multiple hops in Reticulum, information
*must* be encrypted, since Reticulum uses the per-packet encryption to verify routing paths and *must* be encrypted, since Reticulum uses the per-packet encryption to verify routing paths and
keep them alive. keep them alive.
@ -219,10 +219,10 @@ packet.
In actual use of *single* destination naming, it is advisable not to use any uniquely identifying In actual use of *single* destination naming, it is advisable not to use any uniquely identifying
features in aspect naming. Aspect names should be general terms describing what kind of destination features in aspect naming. Aspect names should be general terms describing what kind of destination
is represented. The uniquely identifying aspect is always acheived by the appending the public key, is represented. The uniquely identifying aspect is always achieved by the appending the public key,
which expands the destination into a uniquely identifyable one. Reticulum does this automatically. which expands the destination into a uniquely identifiable one. Reticulum does this automatically.
Any destination on a Reticulum network can be addressed and reached simply by knowning its Any destination on a Reticulum network can be addressed and reached simply by knowing its
destination hash (and public key, but if the public key is not known, it can be requested from the destination hash (and public key, but if the public key is not known, it can be requested from the
network simply by knowing the destination hash). The use of app names and aspects makes it easy to network simply by knowing the destination hash). The use of app names and aspects makes it easy to
structure Reticulum programs and makes it possible to filter what information and data your program structure Reticulum programs and makes it possible to filter what information and data your program
@ -349,7 +349,7 @@ Node Types
---------- ----------
Currently, Reticulum distinguishes between two types of network nodes. All nodes on a Reticulum network Currently, Reticulum distinguishes between two types of network nodes. All nodes on a Reticulum network
are *Reticulum Instances*, and some are alo *Transport Nodes*. If a system running Reticulum is fixed in are *Reticulum Instances*, and some are also *Transport Nodes*. If a system running Reticulum is fixed in
one place, and is intended to be kept available most of the time, it is a good contender to be a *Transport Node*. one place, and is intended to be kept available most of the time, it is a good contender to be a *Transport Node*.
Any Reticulum Instance can become a Transport Node by enabling it in the configuration. Any Reticulum Instance can become a Transport Node by enabling it in the configuration.
@ -485,13 +485,18 @@ For exchanges of larger amounts of data, or when longer sessions of bidirectiona
the destination using a Reticulum Identity. This authentication is happening inside the encrypted the destination using a Reticulum Identity. This authentication is happening inside the encrypted
link, and is only revealed to the verified destination, and no intermediaries. link, and is only revealed to the verified destination, and no intermediaries.
In a moment, we will discuss the details of how this methodology is implemented, but lets first In a moment, we will discuss the details of how this methodology is
recap what purposes this methodology serves. We first ensure that the node answering our request implemented, but lets first recap what purposes this methodology serves. We
is actually the one we want to communicate with, and not a malicious actor pretending to be so. first ensure that the node answering our request is actually the one we want to
At the same time we establish an efficient encrypted channel. The setup of this is relatively cheap in communicate with, and not a malicious actor pretending to be so. At the same
terms of bandwidth, so it can be used just for a short exchange, and then recreated as needed, which will time we establish an efficient encrypted channel. The setup of this is
also rotate encryption keys. The link can also be kept alive for longer periods of time, if this is relatively cheap in terms of bandwidth, so it can be used just for a short
more suitable to the application. The procedure also inserts the *link id* , a hash calculated from the link request packet, into the memory of forwarding nodes, which means that the communicating nodes can thereafter reach each other simply by referring to this *link id*. exchange, and then recreated as needed, which will also rotate encryption keys.
The link can also be kept alive for longer periods of time, if this is more
suitable to the application. The procedure also inserts the *link id* , a hash
calculated from the link request packet, into the memory of forwarding nodes,
which means that the communicating nodes can thereafter reach each other simply
by referring to this *link id*.
The combined bandwidth cost of setting up a link is 3 packets totalling 265 bytes (more info in the The combined bandwidth cost of setting up a link is 3 packets totalling 265 bytes (more info in the
:ref:`Binary Packet Format<understanding-packetformat>` section). The amount of bandwidth used on keeping :ref:`Binary Packet Format<understanding-packetformat>` section). The amount of bandwidth used on keeping
@ -544,7 +549,7 @@ an arbitrary number of hops, where information will be exchanged between two nod
* | By verifying this *link proof* packet, all nodes that originally transported the *link request* * | By verifying this *link proof* packet, all nodes that originally transported the *link request*
packet to the destination from the originator can now verify that the intended destination received packet to the destination from the originator can now verify that the intended destination received
the request and accepted it, and that the path they chose for forwarding the request was valid. the request and accepted it, and that the path they chose for forwarding the request was valid.
In sucessfully carrying out this verification, the transporting nodes marks the link as active. In successfully carrying out this verification, the transporting nodes marks the link as active.
An abstract bi-directional communication channel has now been established along a path in the network. An abstract bi-directional communication channel has now been established along a path in the network.
* | When the source receives the *proof* , it will know unequivocally that a verified path has been * | When the source receives the *proof* , it will know unequivocally that a verified path has been
@ -887,4 +892,4 @@ testing and review as those from OpenSSL.
If you want to use the internal pure-python primitives, it is **highly advisable** that you If you want to use the internal pure-python primitives, it is **highly advisable** that you
have a good understanding of the risks that this pose, and make an informed decision on whether have a good understanding of the risks that this pose, and make an informed decision on whether
those risks are acceptable to you. those risks are acceptable to you.

View File

@ -2,23 +2,38 @@
What is Reticulum? What is Reticulum?
****************** ******************
Reticulum is a cryptography-based networking stack for building wide-area networks with readily available hardware, that can continue to operate even with extremely low bandwidth and very high latency. Reticulum is a cryptography-based networking stack for building wide-area
networks with readily available hardware, that can continue to operate even
with extremely low bandwidth and very high latency.
Reticulum allows you to build wide-area networks with off-the-shelf tools, and offers end-to-end encryption, autoconfiguring cryptographically backed multi-hop transport, efficient addressing, unforgeable packet acknowledgements and more. Reticulum allows you to build wide-area networks with off-the-shelf tools, and
offers end-to-end encryption, autoconfiguring cryptographically backed
multi-hop transport, efficient addressing, unforgeable packet acknowledgements
and more.
Reticulum is a complete networking stack, and does not need IP or higher layers, although it is easy to utilise IP (with TCP or UDP) as the underlying carrier for Reticulum. It is therefore trivial to tunnel Reticulum over the Internet or private IP networks. Reticulum is built directly on cryptographic principles, allowing resilience and stable functionality in open and trustless networks. Reticulum is a complete networking stack, and does not need IP or higher
layers, although it is easy to utilise IP (with TCP or UDP) as the underlying
carrier for Reticulum. It is therefore trivial to tunnel Reticulum over the
Internet or private IP networks. Reticulum is built directly on cryptographic
principles, allowing resilience and stable functionality in open and trustless
networks.
No kernel modules or drivers are required. Reticulum runs completely in userland, and can run on practically any system that runs Python 3. Reticulum runs well even on small single-board computers like the Pi Zero. No kernel modules or drivers are required. Reticulum runs completely in
userland, and can run on practically any system that runs Python 3. Reticulum
runs well even on small single-board computers like the Pi Zero.
Current Status Current Status
============== ==============
Reticulum should currently be considered beta software. All core protocol features are implemented and functioning, but additions will probably occur as real-world use is explored. There will be bugs. The API and wire-format can be considered stable at the moment, but could change if absolutely warranted. Reticulum should currently be considered beta software. All core protocol
features are implemented and functioning, but additions will probably occur as
real-world use is explored. There will be bugs. The API and wire-format can be
considered stable at the moment, but could change if absolutely warranted.
What does Reticulum Offer? What does Reticulum Offer?
========================== ==========================
* Coordination-less globally unique adressing and identification * Coordination-less globally unique addressing and identification
* Fully self-configuring multi-hop routing * Fully self-configuring multi-hop routing
@ -26,7 +41,7 @@ What does Reticulum Offer?
* Asymmetric encryption based on X25519, and Ed25519 signatures as a basis for all communication * Asymmetric encryption based on X25519, and Ed25519 signatures as a basis for all communication
* Forward Secrecy by using ephemereal Elliptic Curve Diffie-Hellman keys on Curve25519 * Forward Secrecy by using ephemeral Elliptic Curve Diffie-Hellman keys on Curve25519
* Reticulum uses the `Fernet <https://github.com/fernet/spec/blob/master/Spec.md>`_ specification for on-the-wire / over-the-air encryption * Reticulum uses the `Fernet <https://github.com/fernet/spec/blob/master/Spec.md>`_ specification for on-the-wire / over-the-air encryption
@ -77,7 +92,7 @@ Reticulum. It is possible to build it yourself, to transform a common LoRa
development board into one, or it can be purchased as a complete transceiver. development board into one, or it can be purchased as a complete transceiver.
Reticulum can also be encapsulated over existing IP networks, so there's Reticulum can also be encapsulated over existing IP networks, so there's
nothing stopping you from using it over wired ethernet or your local WiFi nothing stopping you from using it over wired Ethernet or your local WiFi
network, where it'll work just as well. In fact, one of the strengths of network, where it'll work just as well. In fact, one of the strengths of
Reticulum is how easily it allows you to connect different mediums into a Reticulum is how easily it allows you to connect different mediums into a
self-configuring, resilient and encrypted mesh. self-configuring, resilient and encrypted mesh.
@ -92,15 +107,15 @@ Interface Types and Devices
=========================== ===========================
Reticulum implements a range of generalised interface types that covers the communications hardware that Reticulum can run over. If your hardware is not supported, it's relatively simple to implement an interface class. Currently, Reticulum can use the following devices and communication mediums: Reticulum implements a range of generalised interface types that covers the communications hardware that Reticulum can run over. If your hardware is not supported, it's relatively simple to implement an interface class. Currently, Reticulum can use the following devices and communication mediums:
* Any ethernet device * Any Ethernet device
* WiFi devices * WiFi devices
* Wired ethernet devices * Wired Ethernet devices
* Fibre-optic transceivers * Fibre-optic transceivers
* Data radios with ethernet ports * Data radios with Ethernet ports
* LoRa using `RNode <https://unsigned.io/rnode>`_ * LoRa using `RNode <https://unsigned.io/rnode>`_
@ -135,4 +150,9 @@ For a full list and more details, see the :ref:`Supported Interfaces<interfaces-
Caveat Emptor Caveat Emptor
============== ==============
Reticulum is an experimental networking stack, and should be considered as such. While it has been built with cryptography best-practices very foremost in mind, it has not been externally security audited, and there could very well be privacy-breaking bugs. To be considered secure, Reticulum needs a thourough security review by independt cryptographers and security researchers. If you want to help out, or help sponsor an audit, please do get in touch. Reticulum is an experimental networking stack, and should be considered as
such. While it has been built with cryptography best-practices very foremost in
mind, it has not been externally security audited, and there could very well be
privacy-breaking bugs. To be considered secure, Reticulum needs a thorough
security review by independent cryptographers and security researchers. If you
want to help out, or help sponsor an audit, please do get in touch.

View File

@ -53,7 +53,7 @@ programs exist that allow basic communication and a range of other useful functi
over even extremely low-bandwidth Reticulum networks.</p> over even extremely low-bandwidth Reticulum networks.</p>
<p>These programs will let you get a feel for how Reticulum works. They have been designed <p>These programs will let you get a feel for how Reticulum works. They have been designed
to run well over networks based on LoRa or packet radio, but can also be used completely to run well over networks based on LoRa or packet radio, but can also be used completely
over local WiFi, wired ethernet, the Internet, or any combination.</p> over local WiFi, wired Ethernet, the Internet, or any combination.</p>
<p>As such, it is easy to get started experimenting, without having to set up any radio <p>As such, it is easy to get started experimenting, without having to set up any radio
transceivers or infrastructure just to try it out. Launching the programs on separate transceivers or infrastructure just to try it out. Launching the programs on separate
devices connected to the same WiFi network is enough to get started, and physical devices connected to the same WiFi network is enough to get started, and physical
@ -111,7 +111,7 @@ default is located at <code class="docutils literal notranslate"><span class="pr
or use the interactive <code class="docutils literal notranslate"><span class="pre">rnsconfig</span></code> utility.</p> or use the interactive <code class="docutils literal notranslate"><span class="pre">rnsconfig</span></code> utility.</p>
<p>When Reticulum is started for the first time, it will create a default <p>When Reticulum is started for the first time, it will create a default
configuration file, with one active interface. This default interface uses configuration file, with one active interface. This default interface uses
your existing ethernet and WiFi networks (if any), and only allows you to your existing Ethernet and WiFi networks (if any), and only allows you to
communicate with other Reticulum peers within your local broadcast domains.</p> communicate with other Reticulum peers within your local broadcast domains.</p>
<p>To communicate further, you will have to add one or more interfaces. The default <p>To communicate further, you will have to add one or more interfaces. The default
configuration includes a number of examples, ranging from using TCP over the configuration includes a number of examples, ranging from using TCP over the
@ -122,7 +122,7 @@ or other things you might be used to from other network types.</p>
<p>Once Reticulum knows which interfaces it should use, it will automatically <p>Once Reticulum knows which interfaces it should use, it will automatically
discover topography and configure transport of data to any destinations it discover topography and configure transport of data to any destinations it
knows about.</p> knows about.</p>
<p>In situations where you already have an established WiFi or ethernet network, and <p>In situations where you already have an established WiFi or Ethernet network, and
many devices that want to utilise the same external Reticulum network paths (for example over many devices that want to utilise the same external Reticulum network paths (for example over
LoRa), it will often be sufficient to let one system act as a Reticulum gateway, by LoRa), it will often be sufficient to let one system act as a Reticulum gateway, by
adding any external interfaces to the configuration of this system, and then enabling transport on it. Any adding any external interfaces to the configuration of this system, and then enabling transport on it. Any
@ -144,7 +144,7 @@ however it also leaks more data about the server host.</p>
inspect the connection. Someone could use this information to determine your location or identity. Adversaries inspect the connection. Someone could use this information to determine your location or identity. Adversaries
inspecting your packets may be able to record packet metadata like time of transmission and packet size. inspecting your packets may be able to record packet metadata like time of transmission and packet size.
Even though Reticulum encrypts traffic, TCP does not, so an adversary may be able to use Even though Reticulum encrypts traffic, TCP does not, so an adversary may be able to use
packet inspection to learn that a system is running Reticulum, and what other IP adresses connect to it. packet inspection to learn that a system is running Reticulum, and what other IP addresses connect to it.
Hosting a publicly reachable instance over TCP also requires a publicly reachable IP address, Hosting a publicly reachable instance over TCP also requires a publicly reachable IP address,
which most Internet connections dont offer anymore.</p> which most Internet connections dont offer anymore.</p>
<p>The <code class="docutils literal notranslate"><span class="pre">I2PInterface</span></code> routes messages through the <a class="reference external" href="https://geti2p.net/en/">Invisible Internet Protocol <p>The <code class="docutils literal notranslate"><span class="pre">I2PInterface</span></code> routes messages through the <a class="reference external" href="https://geti2p.net/en/">Invisible Internet Protocol
@ -155,8 +155,8 @@ hide both the sender and receiver Reticulum instance IP addresses. Running an I2
will also relay other I2P users encrypted packets, which will use extra will also relay other I2P users encrypted packets, which will use extra
bandwidth and compute power, but also makes timing attacks and other forms of bandwidth and compute power, but also makes timing attacks and other forms of
deep-packet-inspection much more difficult.</p> deep-packet-inspection much more difficult.</p>
<p>I2P also allows users to host globally available Reticulum instances from non-public IPs and behind firewalls and NAT.</p> <p>I2P also allows users to host globally available Reticulum instances from non-public IPs and behind firewalls and NAT.</p>
<p>In general it is recommended to use an I2P node if you want to host a publically accessible <p>In general it is recommended to use an I2P node if you want to host a publicly accessible
instance, while preserving anonymity. If you care more about performance, and a slightly instance, while preserving anonymity. If you care more about performance, and a slightly
easier setup, use TCP.</p> easier setup, use TCP.</p>
</div> </div>

View File

@ -81,7 +81,7 @@ the discussion to RNodes using <em>LoRa</em> modulation in common ISM bands.</p>
<p><strong>Avoid Confusion!</strong> RNodes can use LoRa as a <em>physical-layer modulation</em>, but it <p><strong>Avoid Confusion!</strong> RNodes can use LoRa as a <em>physical-layer modulation</em>, but it
does not use, and has nothing to do with the <em>LoRaWAN</em> protocol and standard, commonly does not use, and has nothing to do with the <em>LoRaWAN</em> protocol and standard, commonly
used for centrally controlled IoT devices. RNodes use <em>raw LoRa modulation</em>, without used for centrally controlled IoT devices. RNodes use <em>raw LoRa modulation</em>, without
any additional protocol overhead. All high-level protocol funcionality is handled any additional protocol overhead. All high-level protocol functionality is handled
directly by Reticulum.</p> directly by Reticulum.</p>
<div class="section" id="creating-rnodes"> <div class="section" id="creating-rnodes">
<span id="rnode-creating"></span><h3>Creating RNodes<a class="headerlink" href="#creating-rnodes" title="Permalink to this headline"></a></h3> <span id="rnode-creating"></span><h3>Creating RNodes<a class="headerlink" href="#creating-rnodes" title="Permalink to this headline"></a></h3>
@ -204,8 +204,8 @@ get started with producing RNodes.</p>
</div> </div>
<div class="section" id="wifi-based-hardware"> <div class="section" id="wifi-based-hardware">
<h2>WiFi-based Hardware<a class="headerlink" href="#wifi-based-hardware" title="Permalink to this headline"></a></h2> <h2>WiFi-based Hardware<a class="headerlink" href="#wifi-based-hardware" title="Permalink to this headline"></a></h2>
<p>It is possible to use all kinds of both short- and long-range Wifi-based hardware <p>It is possible to use all kinds of both short- and long-range WiFi-based hardware
with Reticulum. Any kind of hardware that fully supports bridged ethernet over the with Reticulum. Any kind of hardware that fully supports bridged Ethernet over the
WiFi interface will work with the <a class="reference internal" href="interfaces.html#interfaces-auto"><span class="std std-ref">AutoInterface</span></a> in Reticulum. WiFi interface will work with the <a class="reference internal" href="interfaces.html#interfaces-auto"><span class="std std-ref">AutoInterface</span></a> in Reticulum.
Most devices will behave like this by default, or allow it via configuration options.</p> Most devices will behave like this by default, or allow it via configuration options.</p>
<p>This means that you can simply configure the physical links of the WiFi based devices, <p>This means that you can simply configure the physical links of the WiFi based devices,

View File

@ -119,12 +119,12 @@ inbound traffic.</p>
and persistent I2P address that your Reticulum instance can be reached and persistent I2P address that your Reticulum instance can be reached
at.</p> at.</p>
<p>To use the I2P interface, you must have an I2P router running <p>To use the I2P interface, you must have an I2P router running
on your system. The easiest way to acheive this is to download and on your system. The easiest way to achieve this is to download and
install the <a class="reference external" href="https://github.com/PurpleI2P/i2pd/releases/latest">latest release</a> install the <a class="reference external" href="https://github.com/PurpleI2P/i2pd/releases/latest">latest release</a>
of the <code class="docutils literal notranslate"><span class="pre">i2pd</span></code> package. For more details about I2P, see the of the <code class="docutils literal notranslate"><span class="pre">i2pd</span></code> package. For more details about I2P, see the
<a class="reference external" href="https://geti2p.net/en/about/intro">geti2p.net website</a>.</p> <a class="reference external" href="https://geti2p.net/en/about/intro">geti2p.net website</a>.</p>
<p>When an I2P router is running on your system, you can simply add <p>When an I2P router is running on your system, you can simply add
an I2P interface to reticulum:</p> an I2P interface to Reticulum:</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">[[</span><span class="n">I2P</span><span class="p">]]</span> <div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">[[</span><span class="n">I2P</span><span class="p">]]</span>
<span class="nb">type</span> <span class="o">=</span> <span class="n">I2PInterface</span> <span class="nb">type</span> <span class="o">=</span> <span class="n">I2PInterface</span>
<span class="n">interface_enabled</span> <span class="o">=</span> <span class="n">yes</span> <span class="n">interface_enabled</span> <span class="o">=</span> <span class="n">yes</span>
@ -260,7 +260,7 @@ over IP networks, so it can provide an easy way to enable connectivity
with all other peers on a local area network.</p> with all other peers on a local area network.</p>
<p><em>Please Note!</em> Using broadcast UDP traffic has performance implications, <p><em>Please Note!</em> Using broadcast UDP traffic has performance implications,
especially on WiFi. If your goal is simply to enable easy communication especially on WiFi. If your goal is simply to enable easy communication
with all peers in your local ethernet broadcast domain, the with all peers in your local Ethernet broadcast domain, the
<a class="reference internal" href="#interfaces-auto"><span class="std std-ref">Auto Interface</span></a> performs better, and is even <a class="reference internal" href="#interfaces-auto"><span class="std std-ref">Auto Interface</span></a> performs better, and is even
easier to use.</p> easier to use.</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="c1"># This example enables communication with other</span> <div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="c1"># This example enables communication with other</span>
@ -381,7 +381,7 @@ directly over a wire-pair, or for using devices such as data radios and lasers.<
</div> </div>
<div class="section" id="pipe-interface"> <div class="section" id="pipe-interface">
<span id="interfaces-pipe"></span><h2>Pipe Interface<a class="headerlink" href="#pipe-interface" title="Permalink to this headline"></a></h2> <span id="interfaces-pipe"></span><h2>Pipe Interface<a class="headerlink" href="#pipe-interface" title="Permalink to this headline"></a></h2>
<p>Using this interface, reticulum can use any program as an interface via <cite>stdin</cite> and <p>Using this interface, Reticulum can use any program as an interface via <cite>stdin</cite> and
<cite>stdout</cite>. This can be used to easily create virtual interfaces, or to interface with <cite>stdout</cite>. This can be used to easily create virtual interfaces, or to interface with
custom hardware or other systems.</p> custom hardware or other systems.</p>
<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">[[</span><span class="n">Pipe</span> <span class="n">Interface</span><span class="p">]]</span> <div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">[[</span><span class="n">Pipe</span> <span class="n">Interface</span><span class="p">]]</span>
@ -396,7 +396,7 @@ custom hardware or other systems.</p>
</pre></div> </pre></div>
</div> </div>
<p>Reticulum will write all packets to <cite>stdin</cite> of the <code class="docutils literal notranslate"><span class="pre">command</span></code> option, and will <p>Reticulum will write all packets to <cite>stdin</cite> of the <code class="docutils literal notranslate"><span class="pre">command</span></code> option, and will
continously read and scan its <cite>stdout</cite> for Reticulum packets. If <code class="docutils literal notranslate"><span class="pre">EOF</span></code> is reached, continuously read and scan its <cite>stdout</cite> for Reticulum packets. If <code class="docutils literal notranslate"><span class="pre">EOF</span></code> is reached,
Reticulum will try to respawn the program after waiting for <code class="docutils literal notranslate"><span class="pre">respawn_interval</span></code> seconds.</p> Reticulum will try to respawn the program after waiting for <code class="docutils literal notranslate"><span class="pre">respawn_interval</span></code> seconds.</p>
</div> </div>
<div class="section" id="kiss-interface"> <div class="section" id="kiss-interface">

View File

@ -48,7 +48,7 @@ Reticulum, which can often be easier than using traditional stacks, since you
dont have to worry about coordinating addresses, subnets and routing for an dont have to worry about coordinating addresses, subnets and routing for an
entire network that you might not know how will evolve in the future. With entire network that you might not know how will evolve in the future. With
Reticulum, you can simply add more segments to your network when it becomes Reticulum, you can simply add more segments to your network when it becomes
necesarry, and Reticulum will handle the convergence of the entire network necessary, and Reticulum will handle the convergence of the entire network
automatically.</p> automatically.</p>
<div class="section" id="concepts-overview"> <div class="section" id="concepts-overview">
<h2>Concepts &amp; Overview<a class="headerlink" href="#concepts-overview" title="Permalink to this headline"></a></h2> <h2>Concepts &amp; Overview<a class="headerlink" href="#concepts-overview" title="Permalink to this headline"></a></h2>
@ -57,15 +57,15 @@ with Reticulum:</p>
<blockquote> <blockquote>
<div><ul> <div><ul>
<li><div class="line-block"> <li><div class="line-block">
<div class="line">In a Reticulum network, any node can autonomously generate as many adresses <div class="line">In a Reticulum network, any node can autonomously generate as many addresses
(called <em>destinations</em> in Reticulum terminology) as it needs, which become (called <em>destinations</em> in Reticulum terminology) as it needs, which become
globally reachable to the rest of the network. There is no central point of globally reachable to the rest of the network. There is no central point of
control over the adress space.</div> control over the address space.</div>
</div> </div>
</li> </li>
<li><div class="line-block"> <li><div class="line-block">
<div class="line">Reticulum was designed to handle both very small, and very large networks. <div class="line">Reticulum was designed to handle both very small, and very large networks.
While the adress space can support billions of endpoints, Reticulum is While the address space can support billions of endpoints, Reticulum is
also very useful when just a few devices needs to communicate.</div> also very useful when just a few devices needs to communicate.</div>
</div> </div>
</li> </li>
@ -163,8 +163,8 @@ need to use the Internet to interconnect the sites, but purchases four Point-to-
WiFi based radios for interconnecting the sites.</p> WiFi based radios for interconnecting the sites.</p>
<p>At each site, a Raspberry Pi is installed to function as a gateway. A LoRa radio <p>At each site, a Raspberry Pi is installed to function as a gateway. A LoRa radio
is connected to the Pi with a USB cable, and the WiFi radio is connected to the is connected to the Pi with a USB cable, and the WiFi radio is connected to the
ethernet port of the Pi. At site B, two WiFi radios are needed to be able to reach Ethernet port of the Pi. At site B, two WiFi radios are needed to be able to reach
both site A and site C, so an extra ethernet adapter is connected to the Pi in both site A and site C, so an extra Ethernet adapter is connected to the Pi in
this location.</p> this location.</p>
<p>Once the hardware has been installed, Reticulum is installed on all the Pis, and at <p>Once the hardware has been installed, Reticulum is installed on all the Pis, and at
site A and C, one interface is added for the LoRa radio, as well as one for the WiFi site A and C, one interface is added for the LoRa radio, as well as one for the WiFi

File diff suppressed because one or more lines are too long

View File

@ -64,7 +64,7 @@ organisation? Make them a reality quickly by sponsoring their implementation.</p
<h2>Provide Feedback<a class="headerlink" href="#provide-feedback" title="Permalink to this headline"></a></h2> <h2>Provide Feedback<a class="headerlink" href="#provide-feedback" title="Permalink to this headline"></a></h2>
<p>All feedback on the usage, functioning and potential dysfunctioning of any and <p>All feedback on the usage, functioning and potential dysfunctioning of any and
all components of the system is very valuable to the continued development and all components of the system is very valuable to the continued development and
improvement of Reticulum. Absolutely no automated analytics, telemetly, error improvement of Reticulum. Absolutely no automated analytics, telemetry, error
reporting or statistics is collected and reported by Reticulum under any reporting or statistics is collected and reported by Reticulum under any
circumstances, so we rely on old-fashioned human feedback.</p> circumstances, so we rely on old-fashioned human feedback.</p>
</div> </div>

View File

@ -98,7 +98,7 @@ critical to ensuring the availability, security and transparency of the system.<
<li><dl class="simple"> <li><dl class="simple">
<dt><strong>Hardware layer agnosticism</strong></dt><dd><p>Reticulum must be fully hardware agnostic, and shall be useable over a wide range of <dt><strong>Hardware layer agnosticism</strong></dt><dd><p>Reticulum must be fully hardware agnostic, and shall be useable over a wide range of
physical networking layers, such as data radios, serial lines, modems, handheld transceivers, physical networking layers, such as data radios, serial lines, modems, handheld transceivers,
wired ethernet, wifi, or anything else that can carry a digital data stream. Hardware made for wired Ethernet, WiFi, or anything else that can carry a digital data stream. Hardware made for
dedicated Reticulum use shall be as cheap as possible and use off-the-shelf components, so dedicated Reticulum use shall be as cheap as possible and use off-the-shelf components, so
it can be easily modified and replicated by anyone interested in doing so.</p> it can be easily modified and replicated by anyone interested in doing so.</p>
</dd> </dd>
@ -159,7 +159,7 @@ needs to be purchased.</p>
<span id="understanding-basicfunctionality"></span><h2>Introduction &amp; Basic Functionality<a class="headerlink" href="#introduction-basic-functionality" title="Permalink to this headline"></a></h2> <span id="understanding-basicfunctionality"></span><h2>Introduction &amp; Basic Functionality<a class="headerlink" href="#introduction-basic-functionality" title="Permalink to this headline"></a></h2>
<p>Reticulum is a networking stack suited for high-latency, low-bandwidth links. Reticulum is at its <p>Reticulum is a networking stack suited for high-latency, low-bandwidth links. Reticulum is at its
core a <em>message oriented</em> system. It is suited for both local point-to-point or point-to-multipoint core a <em>message oriented</em> system. It is suited for both local point-to-point or point-to-multipoint
scenarios where alle nodes are within range of each other, as well as scenarios where packets need scenarios where all nodes are within range of each other, as well as scenarios where packets need
to be transported over multiple hops in a complex network to reach the recipient.</p> to be transported over multiple hops in a complex network to reach the recipient.</p>
<p>Reticulum does away with the idea of addresses and ports known from IP, TCP and UDP. Instead <p>Reticulum does away with the idea of addresses and ports known from IP, TCP and UDP. Instead
Reticulum uses the singular concept of <em>destinations</em>. Any application using Reticulum as its Reticulum uses the singular concept of <em>destinations</em>. Any application using Reticulum as its
@ -168,14 +168,14 @@ destinations it needs to send data to.</p>
<p>All destinations in Reticulum are _represented_ as a 16 byte hash. This hash is derived from truncating a full <p>All destinations in Reticulum are _represented_ as a 16 byte hash. This hash is derived from truncating a full
SHA-256 hash of identifying characteristics of the destination. To users, the destination addresses SHA-256 hash of identifying characteristics of the destination. To users, the destination addresses
will be displayed as 16 hexadecimal bytes, like this example: <code class="docutils literal notranslate"><span class="pre">&lt;13425ec15b621c1d928589718000d814&gt;</span></code>.</p> will be displayed as 16 hexadecimal bytes, like this example: <code class="docutils literal notranslate"><span class="pre">&lt;13425ec15b621c1d928589718000d814&gt;</span></code>.</p>
<p>The truncation size of 16 bytes (128 bits) for destinations has been choosen as a reasonable tradeoff <p>The truncation size of 16 bytes (128 bits) for destinations has been chosen as a reasonable trade-off
between address space between address space
and packet overhead. The address space accomodated by this size can support many billions of and packet overhead. The address space accommodated by this size can support many billions of
simultaneously active devices on the same network, while keeping packet overhead low, which is simultaneously active devices on the same network, while keeping packet overhead low, which is
essential on low-bandwidth networks. In the very unlikely case that this address space nears essential on low-bandwidth networks. In the very unlikely case that this address space nears
congestion, a one-line code change can upgrade the Reticulum address space all the way up to 256 congestion, a one-line code change can upgrade the Reticulum address space all the way up to 256
bits, ensuring the Reticulum address space could potentially support galactic-scale networks. bits, ensuring the Reticulum address space could potentially support galactic-scale networks.
This is obviusly complete and ridiculous over-allocation, and as such, the current 128 bits should This is obviously complete and ridiculous over-allocation, and as such, the current 128 bits should
be sufficient, even far into the future.</p> be sufficient, even far into the future.</p>
<p>By default Reticulum encrypts all data using elliptic curve cryptography. Any packet sent to a <p>By default Reticulum encrypts all data using elliptic curve cryptography. Any packet sent to a
destination is encrypted with a derived ephemeral key. Reticulum can also set up an encrypted destination is encrypted with a derived ephemeral key. Reticulum can also set up an encrypted
@ -205,7 +205,7 @@ only be readable by the creator of the destination, who holds the corresponding
<dt><strong>Plain</strong></dt><dd><p>A <em>plain</em> destination type is unencrypted, and suited for traffic that should be broadcast to a <dt><strong>Plain</strong></dt><dd><p>A <em>plain</em> destination type is unencrypted, and suited for traffic that should be broadcast to a
number of users, or should be readable by anyone. Traffic to a <em>plain</em> destination is not encrypted. number of users, or should be readable by anyone. Traffic to a <em>plain</em> destination is not encrypted.
Generally, <em>plain</em> destinations can be used for broadcast information intended to be public. Generally, <em>plain</em> destinations can be used for broadcast information intended to be public.
Plain destinations are only reachable directly, and packets adressed to plain destinations are Plain destinations are only reachable directly, and packets addressed to plain destinations are
never transported over multiple hops in the network. To be transportable over multiple hops in Reticulum, information never transported over multiple hops in the network. To be transportable over multiple hops in Reticulum, information
<em>must</em> be encrypted, since Reticulum uses the per-packet encryption to verify routing paths and <em>must</em> be encrypted, since Reticulum uses the per-packet encryption to verify routing paths and
keep them alive.</p> keep them alive.</p>
@ -261,9 +261,9 @@ addressable, because their public keys will differ.</p></li>
</ul> </ul>
<p>In actual use of <em>single</em> destination naming, it is advisable not to use any uniquely identifying <p>In actual use of <em>single</em> destination naming, it is advisable not to use any uniquely identifying
features in aspect naming. Aspect names should be general terms describing what kind of destination features in aspect naming. Aspect names should be general terms describing what kind of destination
is represented. The uniquely identifying aspect is always acheived by the appending the public key, is represented. The uniquely identifying aspect is always achieved by the appending the public key,
which expands the destination into a uniquely identifyable one. Reticulum does this automatically.</p> which expands the destination into a uniquely identifiable one. Reticulum does this automatically.</p>
<p>Any destination on a Reticulum network can be addressed and reached simply by knowning its <p>Any destination on a Reticulum network can be addressed and reached simply by knowing its
destination hash (and public key, but if the public key is not known, it can be requested from the destination hash (and public key, but if the public key is not known, it can be requested from the
network simply by knowing the destination hash). The use of app names and aspects makes it easy to network simply by knowing the destination hash). The use of app names and aspects makes it easy to
structure Reticulum programs and makes it possible to filter what information and data your program structure Reticulum programs and makes it possible to filter what information and data your program
@ -373,7 +373,7 @@ know the most direct way to get a packet one hop closer to its destination.</
<div class="section" id="node-types"> <div class="section" id="node-types">
<span id="understanding-nodetypes"></span><h3>Node Types<a class="headerlink" href="#node-types" title="Permalink to this headline"></a></h3> <span id="understanding-nodetypes"></span><h3>Node Types<a class="headerlink" href="#node-types" title="Permalink to this headline"></a></h3>
<p>Currently, Reticulum distinguishes between two types of network nodes. All nodes on a Reticulum network <p>Currently, Reticulum distinguishes between two types of network nodes. All nodes on a Reticulum network
are <em>Reticulum Instances</em>, and some are alo <em>Transport Nodes</em>. If a system running Reticulum is fixed in are <em>Reticulum Instances</em>, and some are also <em>Transport Nodes</em>. If a system running Reticulum is fixed in
one place, and is intended to be kept available most of the time, it is a good contender to be a <em>Transport Node</em>.</p> one place, and is intended to be kept available most of the time, it is a good contender to be a <em>Transport Node</em>.</p>
<p>Any Reticulum Instance can become a Transport Node by enabling it in the configuration. <p>Any Reticulum Instance can become a Transport Node by enabling it in the configuration.
This distinction is made by the user configuring the node, and is used to determine what nodes on the This distinction is made by the user configuring the node, and is used to determine what nodes on the
@ -539,13 +539,18 @@ link, and is only revealed to the verified destination, and no intermediaries.</
</div> </div>
</li> </li>
</ul> </ul>
<p>In a moment, we will discuss the details of how this methodology is implemented, but lets first <p>In a moment, we will discuss the details of how this methodology is
recap what purposes this methodology serves. We first ensure that the node answering our request implemented, but lets first recap what purposes this methodology serves. We
is actually the one we want to communicate with, and not a malicious actor pretending to be so. first ensure that the node answering our request is actually the one we want to
At the same time we establish an efficient encrypted channel. The setup of this is relatively cheap in communicate with, and not a malicious actor pretending to be so. At the same
terms of bandwidth, so it can be used just for a short exchange, and then recreated as needed, which will time we establish an efficient encrypted channel. The setup of this is
also rotate encryption keys. The link can also be kept alive for longer periods of time, if this is relatively cheap in terms of bandwidth, so it can be used just for a short
more suitable to the application. The procedure also inserts the <em>link id</em> , a hash calculated from the link request packet, into the memory of forwarding nodes, which means that the communicating nodes can thereafter reach each other simply by referring to this <em>link id</em>.</p> exchange, and then recreated as needed, which will also rotate encryption keys.
The link can also be kept alive for longer periods of time, if this is more
suitable to the application. The procedure also inserts the <em>link id</em> , a hash
calculated from the link request packet, into the memory of forwarding nodes,
which means that the communicating nodes can thereafter reach each other simply
by referring to this <em>link id</em>.</p>
<p>The combined bandwidth cost of setting up a link is 3 packets totalling 265 bytes (more info in the <p>The combined bandwidth cost of setting up a link is 3 packets totalling 265 bytes (more info in the
<a class="reference internal" href="#understanding-packetformat"><span class="std std-ref">Binary Packet Format</span></a> section). The amount of bandwidth used on keeping <a class="reference internal" href="#understanding-packetformat"><span class="std std-ref">Binary Packet Format</span></a> section). The amount of bandwidth used on keeping
a link open is practically negligible, at 0.45 bits per second. Even on a slow 1200 bits per second packet a link open is practically negligible, at 0.45 bits per second. Even on a slow 1200 bits per second packet
@ -605,7 +610,7 @@ the addressed destination.</div>
<div class="line">By verifying this <em>link proof</em> packet, all nodes that originally transported the <em>link request</em> <div class="line">By verifying this <em>link proof</em> packet, all nodes that originally transported the <em>link request</em>
packet to the destination from the originator can now verify that the intended destination received packet to the destination from the originator can now verify that the intended destination received
the request and accepted it, and that the path they chose for forwarding the request was valid. the request and accepted it, and that the path they chose for forwarding the request was valid.
In sucessfully carrying out this verification, the transporting nodes marks the link as active. In successfully carrying out this verification, the transporting nodes marks the link as active.
An abstract bi-directional communication channel has now been established along a path in the network.</div> An abstract bi-directional communication channel has now been established along a path in the network.</div>
</div> </div>
</li> </li>

View File

@ -43,22 +43,37 @@
<div class="section" id="what-is-reticulum"> <div class="section" id="what-is-reticulum">
<h1>What is Reticulum?<a class="headerlink" href="#what-is-reticulum" title="Permalink to this headline"></a></h1> <h1>What is Reticulum?<a class="headerlink" href="#what-is-reticulum" title="Permalink to this headline"></a></h1>
<p>Reticulum is a cryptography-based networking stack for building wide-area networks with readily available hardware, that can continue to operate even with extremely low bandwidth and very high latency.</p> <p>Reticulum is a cryptography-based networking stack for building wide-area
<p>Reticulum allows you to build wide-area networks with off-the-shelf tools, and offers end-to-end encryption, autoconfiguring cryptographically backed multi-hop transport, efficient addressing, unforgeable packet acknowledgements and more.</p> networks with readily available hardware, that can continue to operate even
<p>Reticulum is a complete networking stack, and does not need IP or higher layers, although it is easy to utilise IP (with TCP or UDP) as the underlying carrier for Reticulum. It is therefore trivial to tunnel Reticulum over the Internet or private IP networks. Reticulum is built directly on cryptographic principles, allowing resilience and stable functionality in open and trustless networks.</p> with extremely low bandwidth and very high latency.</p>
<p>No kernel modules or drivers are required. Reticulum runs completely in userland, and can run on practically any system that runs Python 3. Reticulum runs well even on small single-board computers like the Pi Zero.</p> <p>Reticulum allows you to build wide-area networks with off-the-shelf tools, and
offers end-to-end encryption, autoconfiguring cryptographically backed
multi-hop transport, efficient addressing, unforgeable packet acknowledgements
and more.</p>
<p>Reticulum is a complete networking stack, and does not need IP or higher
layers, although it is easy to utilise IP (with TCP or UDP) as the underlying
carrier for Reticulum. It is therefore trivial to tunnel Reticulum over the
Internet or private IP networks. Reticulum is built directly on cryptographic
principles, allowing resilience and stable functionality in open and trustless
networks.</p>
<p>No kernel modules or drivers are required. Reticulum runs completely in
userland, and can run on practically any system that runs Python 3. Reticulum
runs well even on small single-board computers like the Pi Zero.</p>
<div class="section" id="current-status"> <div class="section" id="current-status">
<h2>Current Status<a class="headerlink" href="#current-status" title="Permalink to this headline"></a></h2> <h2>Current Status<a class="headerlink" href="#current-status" title="Permalink to this headline"></a></h2>
<p>Reticulum should currently be considered beta software. All core protocol features are implemented and functioning, but additions will probably occur as real-world use is explored. There will be bugs. The API and wire-format can be considered stable at the moment, but could change if absolutely warranted.</p> <p>Reticulum should currently be considered beta software. All core protocol
features are implemented and functioning, but additions will probably occur as
real-world use is explored. There will be bugs. The API and wire-format can be
considered stable at the moment, but could change if absolutely warranted.</p>
</div> </div>
<div class="section" id="what-does-reticulum-offer"> <div class="section" id="what-does-reticulum-offer">
<h2>What does Reticulum Offer?<a class="headerlink" href="#what-does-reticulum-offer" title="Permalink to this headline"></a></h2> <h2>What does Reticulum Offer?<a class="headerlink" href="#what-does-reticulum-offer" title="Permalink to this headline"></a></h2>
<ul class="simple"> <ul class="simple">
<li><p>Coordination-less globally unique adressing and identification</p></li> <li><p>Coordination-less globally unique addressing and identification</p></li>
<li><p>Fully self-configuring multi-hop routing</p></li> <li><p>Fully self-configuring multi-hop routing</p></li>
<li><p>Complete initiator anonymity, communicate without revealing your identity</p></li> <li><p>Complete initiator anonymity, communicate without revealing your identity</p></li>
<li><p>Asymmetric encryption based on X25519, and Ed25519 signatures as a basis for all communication</p></li> <li><p>Asymmetric encryption based on X25519, and Ed25519 signatures as a basis for all communication</p></li>
<li><p>Forward Secrecy by using ephemereal Elliptic Curve Diffie-Hellman keys on Curve25519</p></li> <li><p>Forward Secrecy by using ephemeral Elliptic Curve Diffie-Hellman keys on Curve25519</p></li>
<li><p>Reticulum uses the <a class="reference external" href="https://github.com/fernet/spec/blob/master/Spec.md">Fernet</a> specification for on-the-wire / over-the-air encryption</p> <li><p>Reticulum uses the <a class="reference external" href="https://github.com/fernet/spec/blob/master/Spec.md">Fernet</a> specification for on-the-wire / over-the-air encryption</p>
<ul> <ul>
<li><p>All keys are ephemeral and derived from an ECDH key exchange on Curve25519</p></li> <li><p>All keys are ephemeral and derived from an ECDH key exchange on Curve25519</p></li>
@ -99,7 +114,7 @@ has been designed as an example transceiver that is very suitable for
Reticulum. It is possible to build it yourself, to transform a common LoRa Reticulum. It is possible to build it yourself, to transform a common LoRa
development board into one, or it can be purchased as a complete transceiver.</p> development board into one, or it can be purchased as a complete transceiver.</p>
<p>Reticulum can also be encapsulated over existing IP networks, so theres <p>Reticulum can also be encapsulated over existing IP networks, so theres
nothing stopping you from using it over wired ethernet or your local WiFi nothing stopping you from using it over wired Ethernet or your local WiFi
network, where itll work just as well. In fact, one of the strengths of network, where itll work just as well. In fact, one of the strengths of
Reticulum is how easily it allows you to connect different mediums into a Reticulum is how easily it allows you to connect different mediums into a
self-configuring, resilient and encrypted mesh.</p> self-configuring, resilient and encrypted mesh.</p>
@ -113,12 +128,12 @@ network, and vice versa.</p>
<h2>Interface Types and Devices<a class="headerlink" href="#interface-types-and-devices" title="Permalink to this headline"></a></h2> <h2>Interface Types and Devices<a class="headerlink" href="#interface-types-and-devices" title="Permalink to this headline"></a></h2>
<p>Reticulum implements a range of generalised interface types that covers the communications hardware that Reticulum can run over. If your hardware is not supported, its relatively simple to implement an interface class. Currently, Reticulum can use the following devices and communication mediums:</p> <p>Reticulum implements a range of generalised interface types that covers the communications hardware that Reticulum can run over. If your hardware is not supported, its relatively simple to implement an interface class. Currently, Reticulum can use the following devices and communication mediums:</p>
<ul class="simple"> <ul class="simple">
<li><p>Any ethernet device</p> <li><p>Any Ethernet device</p>
<ul> <ul>
<li><p>WiFi devices</p></li> <li><p>WiFi devices</p></li>
<li><p>Wired ethernet devices</p></li> <li><p>Wired Ethernet devices</p></li>
<li><p>Fibre-optic transceivers</p></li> <li><p>Fibre-optic transceivers</p></li>
<li><p>Data radios with ethernet ports</p></li> <li><p>Data radios with Ethernet ports</p></li>
</ul> </ul>
</li> </li>
<li><p>LoRa using <a class="reference external" href="https://unsigned.io/rnode">RNode</a></p> <li><p>LoRa using <a class="reference external" href="https://unsigned.io/rnode">RNode</a></p>
@ -149,7 +164,12 @@ network, and vice versa.</p>
</div> </div>
<div class="section" id="caveat-emptor"> <div class="section" id="caveat-emptor">
<h2>Caveat Emptor<a class="headerlink" href="#caveat-emptor" title="Permalink to this headline"></a></h2> <h2>Caveat Emptor<a class="headerlink" href="#caveat-emptor" title="Permalink to this headline"></a></h2>
<p>Reticulum is an experimental networking stack, and should be considered as such. While it has been built with cryptography best-practices very foremost in mind, it has not been externally security audited, and there could very well be privacy-breaking bugs. To be considered secure, Reticulum needs a thourough security review by independt cryptographers and security researchers. If you want to help out, or help sponsor an audit, please do get in touch.</p> <p>Reticulum is an experimental networking stack, and should be considered as
such. While it has been built with cryptography best-practices very foremost in
mind, it has not been externally security audited, and there could very well be
privacy-breaking bugs. To be considered secure, Reticulum needs a thorough
security review by independent cryptographers and security researchers. If you
want to help out, or help sponsor an audit, please do get in touch.</p>
</div> </div>
</div> </div>