v0.11.0 · Self-certifying nodes. Local proof. No ambient trust.
A Rust network fabric built around self-certifying identities, signed contacts, and local verification. Reach exact services and resources over encrypted connections that can follow changing network paths.
Follow a request through Korium's trust boundaries. The network can help a packet move; only the destination can decide what that movement means.
The node presents a did:korium identity, its raw
Ed25519 key, certificate proof, and PoW. The destination binds
the DID digest to the certificate SPKI before trusting the mTLS
session—without a CA, resolver, or online registry.
Authentication only proves key possession. Inbound application admission is closed until explicitly enabled. A service-authorized node additionally checks an authority-rooted exact-service chain and source policy; protected actions still require a short-lived Biscuit matching issuer, audience, service, resource, and action.
Exact service lookup verifies authority-bound providers. Signed resource placements locate a specific application object under a trusted placement key. Live service bindings and signed source policy still decide who may connect; discovery grants no access.
QUIC uses TLS 1.3 with only X25519 + ML-KEM-768 hybrid key exchange. No classical group is offered, so there is no downgrade path. Identity signatures remain classical Ed25519, stated explicitly, while BLAKE3-384 identifiers keep routing, grants, and logs compact if a future signature primitive becomes much larger.
Korium is addressless by design. Signed contacts carry identity and authority, never network addresses. Transport owns endpoints and reaches discovered identities through consented introductions. Identity, discovery, routing, streams, pub-sub, tunneling, and authorization share one local-verifier trust model. Applications control inbound admission, name services with stable DIDs, place resources with signed records, and verify protected actions locally.
Encrypted QUIC carries messages, streams, and TCP tunnels with BBRv3 congestion control. Open connections can survive NAT rebinding, address changes, and direct-to-relay switches while retaining the same authenticated destination, within their existing deadlines. Request deadlines cover discovery through response reading, and the client never replays a request after timeout. Local mDNS and regular DNS are opt-in, mutually exclusive adapters. Explicit seeds provide wider introduction. Korium requires Rust 1.99.0+; Linux is the production target.
Identity, discovery, transport, stream admission, and L7 authorization share local verification at every protocol edge.
Every node is named by a did:korium URI derived from
the public key. The pubkey travels in band, then BLAKE3-binds to
the URI before signature verification.
Verification does not depend on a DID document fetch, CA, SPIRE server, key registry, or online root. The destination checks the evidence it received.
An explicitly enabled DID-only node leaves handler policy to the application. Supplying exact-service authority activates fail-closed source and stream admission with configured authority roots and an exact signed source policy; protected actions still require a scoped Biscuit.
Korium routes encrypted QUIC sessions by node identity and uses BBRv3 congestion control. Transport validates paths, detects stalled delivery, and selects another live address or eligible relay. Recovery preserves the destination and never replays application work.
Applications explicitly start bounded IPv4 and IPv6 mDNS. Wider introduction uses identity-pinned seeds and literal endpoints. Construction performs no public DNS seed lookup; connections still require signed transport validation and PoW-valid mTLS.
Direct and forwarded QUIC, GossipSub, raw streams, request-response, and TCP tunneling use authenticated fabric paths. Linux batches UDP sends and receives; explicit memory and queue limits bound work under pressure.
TCP tunnel entry carries local application traffic to an identity, exact service, or resource over encrypted QUIC. The destination explicitly enables admission and drains its in-process stream handler.
DHT values, liveness records, RPC bodies, GossipSub messages, grants, lookup expansion, tunnel concurrency, and caches all have explicit caps.
Verified grants return issuer, audience, service DID URL, action, resource, expiry, token digest, and bounded app claims. Complete, durable, or tamper-evident audit collection remains a deployment responsibility.
The did:korium URI carries a 48-byte BLAKE3-384
digest; identity hex uses its first 32 bytes. DHT routing positions
are separately derived from the key and PoW proof, raising the cost
of targeted placement. Scoped routing adds an authority prefix.
Each node owns its tasks, receivers, listeners, and shutdown. DNS and mDNS can stop and restart independently of transport. Awaiting tunnel stop releases its listener and sessions within a bounded grace period.
A Korium node is named by a compact did:korium URI, but
the verifier never treats the URI as the key. The raw public key is
carried as evidence, BLAKE3-bound to the DID, then checked before
any signature or transport claim is trusted.
did:korium gives routing, grants, logs, and audits a stable node name.
The certificate carries the public key; the verifier hashes and compares it locally.
Ed25519 authenticates current identities while BLAKE3-384 keeps the DID compact.
TLS 1.3 offers only X25519 + ML-KEM-768, while identity signatures remain classical and explicit.
Korium uses QUIC and TLS 1.3 mTLS for encrypted node sessions, then carries those sessions over an identity-aware UDP substrate. Direct traffic, forwarded traffic, raw streams, pub-sub, and TCP tunnels all keep encryption separate from authority.
Node-to-node encrypted sessions with mTLS identity and service-scoped admission.
Relay paths forward bounded ciphertext after adjacent-hop token, TTL, and route checks.
Local TCP clients reach destination handlers through encrypted QUIC TUNNEL streams.
GossipSub, raw streams, and request-response keep signatures, replay windows, and size caps.
