v0.11.0 · Self-certifying nodes. Local proof. No ambient trust.
A Rust network fabric built around self-certifying identities, signed contacts, and local verification. Reach exact services and resources over resilient encrypted paths, with explicit grants for every service boundary and protected action.
Follow a request through Korium's trust boundaries. The network can help a packet move; only the destination can decide what that movement means.
The node presents a did:korium identity, its raw
Ed25519 key, certificate proof, and PoW. The destination binds
the DID digest to the certificate SPKI before trusting the mTLS
session—without a CA, resolver, or online registry.
Authentication only proves key possession. Inbound application admission is closed until explicitly enabled. A service-authorized node checks an authority-rooted exact-service chain, then requires an installed source grant for that service pair. Protected actions require a short-lived invocation grant matching audience, service, resource, and action, plus local policy. Grant issuance can follow a bounded, signed delegation chain.
Exact service lookup verifies authority-bound providers. Signed resource placements locate a specific application object under a trusted placement key. Live service bindings and installed source grants decide who may open streams; discovery grants no access.
QUIC uses TLS 1.3 with only X25519 + ML-KEM-768 hybrid key exchange. No classical group is offered, so there is no downgrade path. Identity signatures remain classical Ed25519, stated explicitly, while BLAKE3-384 identifiers keep routing, grants, and logs compact if a future signature primitive becomes much larger.
Korium is addressless by design. Signed contacts carry identity and authority, never network addresses. Transport owns endpoints and reaches discovered identities through consented introductions. Identity, discovery, routing, streams, pub-sub, tunneling, and authorization share one local-verifier trust model. Applications name services with stable DIDs and place resources with signed records. Destination nodes authorize service-to-service streams with signed source grants that applications can install and remove at runtime. Invocation grants bind each protected action to its caller, service, and resource; delegated issuers stay within a bounded chain of proof.
Encrypted QUIC carries messages, streams, and TCP tunnels with BBRv3 congestion control. Open connections can survive NAT rebinding, address changes, and direct-to-relay switches while retaining the same authenticated destination, within their existing deadlines. Request deadlines cover discovery through response reading, and the client never replays a request after timeout. Local mDNS and regular DNS are opt-in, mutually exclusive adapters. Explicit seeds provide wider introduction. Korium requires Rust 1.99.0+; Linux is the production target.
Identity, discovery, transport, stream admission, and L7 authorization share local verification at every protocol edge.
Every node is named by a did:korium URI derived from
the public key. The pubkey travels in band, then BLAKE3-binds to
the URI before signature verification.
Verification does not depend on a DID document fetch, CA, SPIRE server, key registry, or online root. The destination checks the evidence it received.
Exact-service authority proves which service a node represents. Installed source grants authorize each source and destination pair. Applications can change those permissions without restarting the node; protected actions still require an invocation grant.
Korium routes encrypted QUIC sessions by node identity and uses BBRv3 congestion control. Transport validates paths, detects stalled delivery, and selects another live address or eligible relay. Recovery preserves the destination and never replays application work.
Applications explicitly start bounded IPv4 and IPv6 mDNS. Wider introduction uses identity-pinned seeds and literal endpoints. Construction performs no public DNS seed lookup; connections still require signed transport validation and PoW-valid mTLS. Fixed RTT bands guide query scheduling while results retain XOR-distance order.
Direct and forwarded QUIC, GossipSub, raw streams, request-response, and TCP tunneling use authenticated fabric paths. Linux batches UDP sends and receives; explicit memory and queue limits bound work under pressure. Accepted stream writers can observe remote stop notifications without a pending write.
TCP tunnel entry carries local application traffic to an identity, exact service, or resource over encrypted QUIC. The destination explicitly enables admission and drains its in-process stream handler.
A grant carries at most four signed blocks, including its terminal invocation. Each link preserves the service and narrows lifetime or scope. The terminal grant names one caller and exact rights; destination verification and local policy make the decision.
Verified grants expose their issuer chain, per-link revocation IDs, audience, action, resource, expiry, and bounded app claims. Complete, durable, or tamper-evident audit collection remains a deployment responsibility.
The did:korium URI carries a 48-byte BLAKE3-384
digest; identity hex uses its first 32 bytes. DHT routing positions
are separately derived from the key and PoW proof, raising the cost
of targeted placement. Scoped routing adds an authority prefix.
Each node owns its tasks, receivers, listeners, and shutdown. DNS and mDNS can stop and restart independently of transport. Awaiting tunnel stop releases its listener and sessions within a bounded grace period.
A Korium node is named by a compact did:korium URI, but
the verifier never treats the URI as the key. The raw public key is
carried as evidence, BLAKE3-bound to the DID, then checked before
any signature or transport claim is trusted.
did:korium gives routing, grants, logs, and audits a stable node name.
The certificate carries the public key; the verifier hashes and compares it locally.
Ed25519 authenticates current identities while BLAKE3-384 keeps the DID compact.
TLS 1.3 offers only X25519 + ML-KEM-768, while identity signatures remain classical and explicit.
Korium uses QUIC and TLS 1.3 mTLS for encrypted node sessions, then carries those sessions over an identity-aware UDP substrate. Direct traffic, forwarded traffic, raw streams, pub-sub, and TCP tunnels all keep encryption separate from authority.
Node-to-node encrypted sessions with mTLS identity and service-scoped admission.
Relay paths forward bounded ciphertext after adjacent-hop token, TTL, and route checks.
Local TCP clients reach destination handlers through encrypted QUIC TUNNEL streams.
GossipSub, raw streams, and request-response keep signatures, replay windows, and size caps.
