v0.8.33 · Self-certifying nodes. Local proof. No ambient trust.
A Rust cryptographic network fabric where discovery, naming, routing, streams, pub-sub, tunneling, and authorization converge on the same local verifier—and every owned task has a clean end.
Follow a request through the live surface of Korium 0.8.33. The network can help a packet move; only the destination can decide what that movement means.
The node presents a did:korium identity, its raw
Ed25519 key, certificate proof, and PoW. The destination binds
the DID digest to the certificate SPKI before trusting the mTLS
session—without a CA, resolver, or online registry.
Authentication only proves key possession. A DID-only node exposes only the handlers its application chooses. A verified service additionally checks source policy and service authority; protected actions still require a short-lived Biscuit matching issuer, audience, service, resource, and action.
A urn:korium name identifies the service across
instance and key rotation. Namespace-root authority bundles and
signed lease chains prove which ephemeral node may speak for
that name; the URN itself never implies access.
QUIC uses X25519 + ML-KEM-768 hybrid key exchange. Identity signatures remain classical Ed25519, stated explicitly, while BLAKE3-384 identifiers keep routing, grants, and logs compact if a future signature primitive becomes much larger.
Korium is valuable because it refuses to let connectivity become authority. Identity, discovery, routing, streams, pub-sub, tunneling, and authorization share one local-verifier trust model instead of being glued together by every application. Version 0.8.33 adds root-authorized, exact-URN instance delegation so service holders can scale out after the namespace-root secret has been destroyed, without widening the inherited service or authorization policy.
Identity, discovery, transport, stream admission, and L7 authorization are not glued together by each application. They share protocol-edge checks.
Every node is named by a did:korium URI derived from
the public key. The pubkey travels in band, then BLAKE3-binds to
the URI before signature verification.
Verification does not depend on a DID document fetch, CA, SPIRE server, key registry, or online root. The destination checks the evidence it received.
DID-only nodes leave handler policy to the application. Supplying verified service identity activates fail-closed source and stream admission; protected actions still require a scoped Biscuit.
Quinn runs over a Korium UDP substrate that routes by identity, observes addresses, signs probes, and forwards only bounded encrypted QUIC traffic.
PING, PINGPONG, PONG, PUNCH, RTT tiering, observed addresses, DHT hints, and QUIC attempts feed the same identity-indexed routing state.
Direct QUIC, forwarded QUIC, adjacent NAT traversal, DNS-facing discovery, GossipSub, raw streams, request-response, and TCP tunneling are all carried by authenticated fabric paths.
TCP tunnel entry tries native TLS 1.3 mTLS/TCP to the destination before falling back to encrypted QUIC TUNNEL streams over the mesh.
DHT values, liveness records, RPC bodies, GossipSub messages, grants, lookup expansion, tunnel concurrency, and caches all have explicit caps.
Verified grants return issuer, audience, service URN, action, resource, expiry, token digest, and bounded app claims. Complete, durable, or tamper-evident audit collection remains a deployment responsibility.
The did:korium URI carries a 48-byte BLAKE3-384
digest; the routing identity uses its first 32 bytes. Neither
embeds the raw public key, keeping identity fields compact.
Identity, authority, authz, naming, DHT, transport, fabric, GossipSub, tunnel, and node composition own distinct invariants. Actor loops and sessions are cancelled and drained by their runtime owner.
A Korium node is named by a compact did:korium URI, but
the verifier never treats the URI as the key. The raw public key is
carried as evidence, BLAKE3-bound to the DID, then checked before
any signature or transport claim is trusted.
did:korium gives routing, grants, logs, and audits a stable node name.
The certificate carries the public key; the verifier hashes and compares it locally.
Ed25519 authenticates current identities while BLAKE3-384 keeps the DID compact.
X25519 + ML-KEM-768 protects key exchange, while identity signatures remain classical and explicit.
Korium uses QUIC and TLS 1.3 mTLS for encrypted node sessions, then carries those sessions over an identity-aware UDP substrate. Direct traffic, forwarded traffic, raw streams, pub-sub, and TCP tunnels all keep encryption separate from authority.
Node-to-node encrypted sessions with mTLS identity and service-scoped admission.
Relay paths forward bounded ciphertext after adjacent-hop token, TTL, and route checks.
Direct mTLS/TCP is tried first, then encrypted QUIC TUNNEL streams over the fabric.
GossipSub, raw streams, and request-response keep signatures, replay windows, and size caps.
