Run NodesReferencenetwork

dialer

Package dialer

import "github.com/luxfi/node/network/dialer"

Functions

DestinationFromPublicKeys

func DestinationFromPublicKeys(edPublicKey, xPublicKey []byte) ([endpoints.RNSDestinationLen]byte, error)

DestinationFromPublicKeys computes the destination hash from public keys. This is useful for computing destinations without creating full identity objects.

VerifyWithPubKey

func VerifyWithPubKey(publicKey, message, signature []byte) bool

VerifyWithPubKey is an alias for VerifyWithPublicKey. Used by the RNS link protocol.

VerifyWithPublicKey

func VerifyWithPublicKey(publicKey, message, signature []byte) bool

VerifyWithPublicKey verifies a signature using an external public key. This is a static method for verifying signatures from other identities.

Types

Announce

Announce represents a Reticulum destination announcement.

func UnmarshalAnnounce(data []byte) (*Announce, error)
func (a *Announce) Marshal() []byte
func (a *Announce) Sign(priv ed25519.PrivateKey)
func (a *Announce) SignableBytes() []byte
func (a *Announce) Verify() bool
func (a *Announce) VerifyDestination() bool

AnnounceEntry

AnnounceEntry contains information about a known destination.

AnnounceHandler

AnnounceHandler receives validated announcements.

AnnounceHandlerFunc

AnnounceHandlerFunc adapts a function to AnnounceHandler.

func (f AnnounceHandlerFunc) OnAnnounce(a *Announce) error

Announcer

Announcer manages announcement creation, validation, and propagation.

func NewAnnouncer(config AnnouncerConfig, logger log.Logger) *Announcer
func (a *Announcer) AddHandler(h AnnounceHandler)
func (a *Announcer) CreateAnnounce() (*Announce, error)
func (a *Announcer) DestTable() *DestTable
func (a *Announcer) HandleReceived(data []byte) (*Announce, error)
func (a *Announcer) Lookup(dest [AnnounceDestLen]byte) *Announce
func (a *Announcer) SetBroadcastFunc(fn func(*Announce) error)
func (a *Announcer) SetIdentity(identity *RNSIdentity, appData []byte)
func (a *Announcer) Start()
func (a *Announcer) Stop()
func (a *Announcer) Validate(ann *Announce) error

AnnouncerConfig

AnnouncerConfig configures the Announcer.

func DefaultAnnouncerConfig() AnnouncerConfig

Config

DNSCacheConfig

DNSCacheConfig configures the DNS resolution cache.

func DefaultDNSCacheConfig() DNSCacheConfig

DestTable

DestTable tracks destinations with LRU eviction and expiry.

func NewDestTable(maxSize int, expiry time.Duration) *DestTable
func (t *DestTable) All() []*Announce
func (t *DestTable) Get(dest [AnnounceDestLen]byte) *Announce
func (t *DestTable) Len() int
func (t *DestTable) Prune() int
func (t *DestTable) Put(a *Announce) bool
func (t *DestTable) Remove(dest [AnnounceDestLen]byte)

Dialer

Dialer attempts to create a connection with the provided IP/port pair

func NewDialer(network string, dialerConfig Config, logger log.Logger) Dialer

EndpointDialer

EndpointDialer attempts to create a connection with IP:port, hostname:port, or RNS destination.

func NewEndpointDialer(network string, config EndpointDialerConfig, logger log.Logger) EndpointDialer

EndpointDialerConfig

EndpointDialerConfig extends Config with DNS and RNS settings.

HybridIdentity

HybridIdentity represents a post-quantum hybrid RNS identity. It combines classical (Ed25519/X25519) and post-quantum (ML-DSA-65/ML-KEM-768) algorithms for TLS 1.3-like hybrid security.

func LoadHybridIdentity(path string) (*HybridIdentity, error)
func LoadOrGenerateHybridIdentity(path string) (*HybridIdentity, error)
func NewHybridIdentity() (*HybridIdentity, error)
func (id *HybridIdentity) Close() error
func (id *HybridIdentity) Destination() [endpoints.RNSDestinationLen]byte
func (id *HybridIdentity) Hash() [endpoints.RNSDestinationLen]byte
func (id *HybridIdentity) HybridDecapsulate(ciphertext []byte) ([]byte, error)
func (id *HybridIdentity) HybridEncapsulate(recipientPub *HybridPublicIdentity) ([]byte, []byte, error)
func (id *HybridIdentity) HybridKEMPublicKey() []byte
func (id *HybridIdentity) IsHybrid() bool
func (id *HybridIdentity) MLDSAPublicKey() []byte
func (id *HybridIdentity) PublicIdentity() (*HybridPublicIdentity, error)
func (id *HybridIdentity) Save(path string) error
func (id *HybridIdentity) Sign(message []byte) ([]byte, error)
func (id *HybridIdentity) SignEd25519(message []byte) []byte
func (id *HybridIdentity) SignMLDSA(message []byte) ([]byte, error)
func (id *HybridIdentity) SigningPublicKey() []byte
func (id *HybridIdentity) ToClassicalIdentity() (*RNSIdentity, error)
func (id *HybridIdentity) Verify(message, signature []byte) bool
func (id *HybridIdentity) X25519PublicKey() [x25519KeySize]byte

HybridPublicIdentity

HybridPublicIdentity represents the public portion of a hybrid identity. Used for verifying signatures and encapsulating secrets to remote peers.

func NewHybridPublicIdentity(
	edPubKey, xPubKey []byte,
	mldsaPubKey *mldsa.PublicKey,
	hybridKEMPubKey kem.PublicKey,
) (*HybridPublicIdentity, error)
func UnmarshalHybridPublicIdentity(data []byte) (*HybridPublicIdentity, error)
func (pub *HybridPublicIdentity) Destination() [endpoints.RNSDestinationLen]byte
func (pub *HybridPublicIdentity) HybridKEMPublicKey() []byte
func (pub *HybridPublicIdentity) MLDSAPublicKey() []byte
func (pub *HybridPublicIdentity) MarshalBinary() ([]byte, error)
func (pub *HybridPublicIdentity) SigningPublicKey() []byte
func (pub *HybridPublicIdentity) Verify(message, signature []byte) bool
func (pub *HybridPublicIdentity) X25519PublicKey() [x25519KeySize]byte

PublicIdentity

PublicIdentity represents a read-only identity from public keys. This is used to verify signatures and encrypt messages to a remote identity.

func NewPublicIdentity(edPublicKey, xPublicKey []byte) (*PublicIdentity, error)
func UnmarshalPublicIdentity(data []byte) (*PublicIdentity, error)
func (pi *PublicIdentity) Destination() [endpoints.RNSDestinationLen]byte
func (pi *PublicIdentity) EncryptionPublicKey() []byte
func (pi *PublicIdentity) MarshalBinary() ([]byte, error)
func (pi *PublicIdentity) PublicKey() []byte
func (pi *PublicIdentity) Verify(message, signature []byte) bool

RNSAnnouncer

RNSAnnouncer wraps Announcer with the interface expected by rns_transport.go.

func NewRNSAnnouncer(identity *RNSIdentity, config RNSAnnouncerConfig, loggers ...log.Logger) *RNSAnnouncer
func (a *RNSAnnouncer) AddEntry(entry *AnnounceEntry)
func (a *RNSAnnouncer) Announce() error
func (a *RNSAnnouncer) GetTable() map[[endpoints.RNSDestinationLen]byte]*AnnounceEntry
func (a *RNSAnnouncer) Lookup(dest [endpoints.RNSDestinationLen]byte) *Announce
func (a *RNSAnnouncer) LookupEntry(dest [endpoints.RNSDestinationLen]byte) (*AnnounceEntry, error)
func (a *RNSAnnouncer) ProcessAnnouncement(packet []byte, transportAddr netip.AddrPort) error
func (a *RNSAnnouncer) RegisterHandler(handler interface{})
func (a *RNSAnnouncer) Size() int
func (a *RNSAnnouncer) Start() error

RNSAnnouncerConfig

RNSAnnouncerConfig configures the RNS announcer.

func DefaultRNSAnnouncerConfig() RNSAnnouncerConfig

RNSConfig

RNSConfig configures the Reticulum Network Stack transport.

func DefaultRNSConfig() RNSConfig

RNSIdentity

RNSIdentity represents a Reticulum Network Stack identity. It consists of an Ed25519 keypair for signing and an X25519 keypair for encryption. The destination hash is derived from the public keys.

func LoadOrGenerateIdentity(path string) (*RNSIdentity, error)
func LoadRNSIdentity(path string) (*RNSIdentity, error)
func NewRNSIdentity() (*RNSIdentity, error)
func (id *RNSIdentity) Close() error
func (id *RNSIdentity) Decrypt(ephemeralPublicKey []byte) (sharedSecret []byte, err error)
func (id *RNSIdentity) Destination() [endpoints.RNSDestinationLen]byte
func (id *RNSIdentity) Encrypt(recipientXPublicKey []byte) (ephemeralPub []byte, sharedSecret []byte, err error)
func (id *RNSIdentity) EncryptionPublicKey() []byte
func (id *RNSIdentity) Hash() [endpoints.RNSDestinationLen]byte
func (id *RNSIdentity) PublicKey() []byte
func (id *RNSIdentity) Save(path string) error
func (id *RNSIdentity) Sign(message []byte) []byte
func (id *RNSIdentity) SigningPublicKey() []byte
func (id *RNSIdentity) Verify(message, signature []byte) bool
func (id *RNSIdentity) X25519Exchange(peerPublicKey [x25519KeySize]byte) ([x25519KeySize]byte, error)
func (id *RNSIdentity) X25519PublicKey() [x25519KeySize]byte

RNSLink

RNSLink represents an encrypted bidirectional link between two RNS identities. Supports both classical (X25519-only) and hybrid (X25519 + ML-KEM-768) modes.

func NewHybridRNSLink(conn net.Conn, identity *HybridIdentity) *RNSLink
func NewRNSLink(conn net.Conn, identity *RNSIdentity) *RNSLink
func (l *RNSLink) Close() error
func (l *RNSLink) Handshake(initiator bool, peerDestination [endpoints.RNSDestinationLen]byte) error
func (l *RNSLink) IsEstablished() bool
func (l *RNSLink) IsHybrid() bool
func (l *RNSLink) LocalAddr() net.Addr
func (l *RNSLink) PeerDestination() [endpoints.RNSDestinationLen]byte
func (l *RNSLink) PeerIdentity() *HybridPublicIdentity
func (l *RNSLink) Read(b []byte) (int, error)
func (l *RNSLink) RemoteAddr() net.Addr
func (l *RNSLink) SetDeadline(t time.Time) error
func (l *RNSLink) SetReadDeadline(t time.Time) error
func (l *RNSLink) SetWriteDeadline(t time.Time) error
func (l *RNSLink) Write(b []byte) (int, error)

RNSTransport

RNSTransport provides connectivity over Reticulum Network Stack. Implementations wrap RNS Links as net.Conn interfaces.

func NewRNSTransport(config RNSConfig, logger log.Logger) RNSTransport

ZWingDialer

ZWingDialer wraps an underlying EndpointDialer so every produced net.Conn is upgraded with a Z-Wing 1-RTT mutual-auth handshake.

The base dialer is responsible for picking the transport (plain TCP or RNS mesh link); the Z-Wing layer is identical in both cases — the secure channel rides byte-for-byte over whatever bytes the base transport delivers.

func NewZWingDialer(base EndpointDialer, cfg ZWingDialerConfig, logger log.Logger) (*ZWingDialer, error)
func (z *ZWingDialer) Dial(
	ctx context.Context,
	ip netip.AddrPort,
	expectedRemote *zwing.IdentityPublic,
) (net.Conn, error)
func (z *ZWingDialer) DialEndpoint(
	ctx context.Context,
	endpoint endpoints.Endpoint,
	expectedRemote *zwing.IdentityPublic,
) (net.Conn, error)
func (z *ZWingDialer) Wrap(raw net.Conn, expectedRemote *zwing.IdentityPublic) (net.Conn, error)

ZWingDialerConfig

ZWingDialerConfig configures a Z-Wing-secured dialer.

ZWingListener

ZWingListener wraps a raw TCP/RNS listener so every accepted connection is post-handshake by the time the caller sees it. The listener spec mirrors zwing.Listen but is built on top of any net.Listener to reuse the existing RNS / TCP listener plumbing.

func NewZWingListener(raw net.Listener, cfg ZWingDialerConfig, logger log.Logger) (*ZWingListener, error)
func (l *ZWingListener) Accept() (net.Conn, error)
func (l *ZWingListener) Addr() net.Addr
func (l *ZWingListener) Close() error
network
Package network
kem
Package kem implements post-quantum key encapsulation for the Lux node peer handshake.