v0.8.38 · Self-certifying nodes. Local proof. No ambient trust.
A Rust cryptographic network fabric where discovery, naming, routing, streams, pub-sub, tunneling, and authorization converge on the same local verifier—and every owned task has a clean end.
Follow a request through the live surface of Korium 0.8.38. The network can help a packet move; only the destination can decide what that movement means.
The node presents a did:korium identity, its raw
Ed25519 key, certificate proof, and PoW. The destination binds
the DID digest to the certificate SPKI before trusting the mTLS
session—without a CA, resolver, or online registry.
Authentication only proves key possession. A DID-only node exposes only the handlers its application chooses. A service-authorized node additionally checks a namespace-rooted exact-service chain and source policy; protected actions still require a short-lived Biscuit matching issuer, audience, service, resource, and action.
Exact service liveness names the nodes currently claiming a service. Optional namespace membership is signed by a separate discovery root and only lists service URNs; an exact-service authority bundle and configured namespace roots still decide who may connect.
QUIC and direct TCP use TLS 1.3 with only X25519 + ML-KEM-768 hybrid key exchange. No classical group is offered, so there is no downgrade path. Identity signatures remain classical Ed25519, stated explicitly, while BLAKE3-384 identifiers keep routing, grants, and logs compact if a future signature primitive becomes much larger.
Korium is valuable because it refuses to let connectivity become authority. Identity, discovery, routing, streams, pub-sub, tunneling, and authorization share one local-verifier trust model instead of being glued together by every application. Version 0.8.38 adds bounded IPv4 and IPv6 mDNS for authenticated local discovery. Public DNS bootstrap is default-off and explicit: applications and the CLI may opt into bounded, best-effort TXT hints without making local mDNS depend on internet access, while identity-pinned seed files and joins remain operator-controlled alternatives. Service authority remains namespace-rooted and exact-service scoped; namespace discovery remains separate from network permission. It retains TLS 1.3 with only X25519 + ML-KEM-768, transport-drop telemetry, and fail-closed cryptographic validation.
Identity, discovery, transport, stream admission, and L7 authorization are not glued together by each application. They share protocol-edge checks.
Every node is named by a did:korium URI derived from
the public key. The pubkey travels in band, then BLAKE3-binds to
the URI before signature verification.
Verification does not depend on a DID document fetch, CA, SPIRE server, key registry, or online root. The destination checks the evidence it received.
DID-only nodes leave handler policy to the application. Supplying exact-service authority activates fail-closed source and stream admission with configured namespace roots and an exact signed source policy; protected actions still require a scoped Biscuit.
Quinn runs over a Korium UDP substrate that routes by identity, observes addresses, signs probes, and forwards only bounded encrypted QUIC traffic.
Local nodes browse and advertise through IPv4 and IPv6 mDNS by default. Wider introduction can use identity-pinned seeds or an opt-in, seven-second-bounded public DNS lookup. Bootstrap failure leaves local discovery available; every accepted route hint must still pass signed transport validation and PoW-valid mTLS.
Direct QUIC, forwarded QUIC, adjacent NAT traversal, local mDNS, DNS-facing discovery, GossipSub, raw streams, request-response, and TCP tunneling are all carried by authenticated fabric paths.
TCP tunnel entry tries native TLS 1.3 mTLS/TCP to the destination before falling back to encrypted QUIC TUNNEL streams over the mesh.
DHT values, liveness records, RPC bodies, GossipSub messages, grants, lookup expansion, tunnel concurrency, and caches all have explicit caps.
Verified grants return issuer, audience, service URN, action, resource, expiry, token digest, and bounded app claims. Complete, durable, or tamper-evident audit collection remains a deployment responsibility.
The did:korium URI carries a 48-byte BLAKE3-384
digest; the routing identity uses its first 32 bytes. Neither
embeds the raw public key, keeping identity fields compact.
Identity, authority, authz, naming, DHT, transport, fabric, GossipSub, tunnel, and node composition own distinct invariants. Actor loops and sessions are cancelled and drained by their runtime owner.
A Korium node is named by a compact did:korium URI, but
the verifier never treats the URI as the key. The raw public key is
carried as evidence, BLAKE3-bound to the DID, then checked before
any signature or transport claim is trusted.
did:korium gives routing, grants, logs, and audits a stable node name.
The certificate carries the public key; the verifier hashes and compares it locally.
Ed25519 authenticates current identities while BLAKE3-384 keeps the DID compact.
TLS 1.3 offers only X25519 + ML-KEM-768, while identity signatures remain classical and explicit.
Korium uses QUIC and TLS 1.3 mTLS for encrypted node sessions, then carries those sessions over an identity-aware UDP substrate. Direct traffic, forwarded traffic, raw streams, pub-sub, and TCP tunnels all keep encryption separate from authority.
Node-to-node encrypted sessions with mTLS identity and service-scoped admission.
Relay paths forward bounded ciphertext after adjacent-hop token, TTL, and route checks.
Direct mTLS/TCP is tried first, then encrypted QUIC TUNNEL streams over the fabric.
GossipSub, raw streams, and request-response keep signatures, replay windows, and size caps.
