laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-07-30 19:46:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update docs for persistent identity, ECN, and multi-transport

Browse Source 
- fips-configuration.md: add node.identity.persistent parameter and
  three-tier identity resolution documentation
- fips-intro.md: update ECN description from "reserves space" to
  reflect implemented hop-by-hop CE signaling
- README.md: update transport list (UDP, TCP, Ethernet), add
  persistent identity mention
This commit is contained in:
Johnathan Corgan
2026-03-06 21:20:16 +00:00
parent e99654d464
commit 79feb41a88
3 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+6 -3
View File
@@ -30,7 +30,7 @@ sessions across the mesh.
- **Self-organizing mesh routing** — spanning tree coordinates and bloom
filter candidate selection, no global routing tables
- **Multi-transport** — UDP/IP overlay today; designed for Ethernet,
- **Multi-transport** — UDP, TCP, and Ethernet today; designed for
Bluetooth, serial, radio, and Tor
- **Noise encryption** — hop-by-hop link encryption plus independent
end-to-end session encryption
@@ -100,7 +100,10 @@ peers: # peers:
```
The `nsec` field accepts bech32 (`nsec1...`) or hex-encoded secret keys.
Omit it entirely for an ephemeral identity that changes each restart.
Omit `nsec` for an ephemeral identity that changes each restart, or set
`node.identity.persistent: true` to auto-generate and reuse a stable
identity via key file (see
[fips-configuration.md](docs/design/fips-configuration.md#identity-nodeidentity)).
See [docs/design/fips-configuration.md](docs/design/fips-configuration.md) for
the full configuration reference.
@@ -180,7 +183,7 @@ testing/ Docker-based integration test harnesses
## Status & Roadmap
FIPS is at **v0.1.0 (alpha)**. The core protocol works end-to-end over
UDP/IP overlays but has not been tested beyond small meshes.
UDP, TCP, and Ethernet but has not been tested beyond small meshes.
### What works today
docs/design/fips-configuration.md
+15 -2
View File
@@ -70,7 +70,19 @@ handle infrastructure concerns only.
| Parameter | Type | Default | Description |
|-----------|------|---------|-------------|
| `node.identity.nsec` | string | *(generate random)* | Hex-encoded secret key. If omitted, an ephemeral identity is generated on each start. |
| `node.identity.nsec` | string | *(none)* | Secret key in nsec (bech32) or hex format. If omitted, behavior depends on `persistent`. |
| `node.identity.persistent` | bool | `false` | Persist identity across restarts via key file. |
Identity resolution follows a three-tier priority:
1. **Explicit `nsec`** in config — always used when present, regardless of `persistent`
2. **Persistent key file** — when `persistent: true` and no `nsec`, loads from `fips.key`
adjacent to the config file; if no key file exists, generates a new keypair and saves it
3. **Ephemeral** — when `persistent: false` (default) and no `nsec`, generates a fresh
keypair on each start
Key files (`fips.key` with mode 0600, `fips.pub` with mode 0644) are written adjacent
to the highest-priority config file for operator visibility, even in ephemeral mode.
### General
@@ -442,7 +454,8 @@ The full YAML structure with all defaults:
```yaml
node:
identity:
nsec: null # hex secret key (null = generate ephemeral)
nsec: null # secret key in nsec or hex (null = depends on persistent)
persistent: false # true = load/save fips.key; false = ephemeral each start
leaf_only: false
tick_interval_secs: 1
base_rtt_ms: 100
docs/design/fips-intro.md
+5 -2
View File
@@ -739,9 +739,12 @@ for wireless mesh routing and is used in protocols including
and [Babel](https://www.irif.fr/~jch/software/babel/). FIPS computes ETX
per-link from MMP loss measurements for future use in candidate ranking.
The CE (Congestion Experienced) echo flag reserves space for
The CE (Congestion Experienced) echo flag provides hop-by-hop
[ECN](https://en.wikipedia.org/wiki/Explicit_Congestion_Notification)
signaling, following the TCP/IP ECN echo pattern (RFC 3168).
signaling, following the TCP/IP ECN echo pattern (RFC 3168). Transit nodes
detect congestion via MMP loss/ETX metrics or kernel buffer drops and set
the CE flag on forwarded frames; destination nodes mark ECN-capable IPv6
packets accordingly.
### Cryptographic Primitives