mirror of
https://github.com/luxfi/pqrns.git
synced 2026-10-30 15:21:45 +00:00
zeekay
c97c4ec940
PQ-RNS extends the Reticulum Network Stack (markqvist/Reticulum) with
a hybrid PQ identity and key-exchange layer without forking the
reference protocol. Capability-negotiated; mixed networks coexist
with native classical RNS peers.
Initial drop:
- cmd/pqrnsd daemon: serve / announce / dial / identity / version
- pkg/identity hybrid identity wire layout (PublicIdentitySize = 3200 bytes)
Ed25519 || X25519 || ML-DSA-65 || ML-KEM-768
16-byte SHA-256 fingerprint (matches native RNS shape)
- pkg/link (skeleton; hybrid link establishment + session KDF)
- pkg/announce (skeleton; capability-bearing announce frames)
- pkg/cap (skeleton; capability negotiation:
require / hybrid_full / hybrid_psk modes)
- .github/workflows CI (build / vet / test / gofmt)
- LICENSE Apache-2.0
- README crypto stack, layout, config, composition, status
Primitives:
identity sig Ed25519 + ML-DSA-65 (FIPS 204)
KEX X25519 + ML-KEM-768 (FIPS 203)
session enc AES-256-CBC + HMAC-SHA-256 (unchanged from native RNS)
KDF HKDF-SHA-256 with explicit per-layer context strings:
PQRNS-LINK-v1
PQRNS-IDENTITY-SIG-v1
PQRNS-ANNOUNCE-SIG-v1
PQRNS-LINK-REKEY-v1
The paper at luxfi/papers/pq-rns/pq-rns.tex is the authoritative spec.
Implementation tracks the paper.
Composition: pairs with luxfi/zwing (TCP/IP transport) and luxfi/pqsafe
(file envelope). Carrier-agnostic; the PQSAFE envelope rides either
Z-Wing on TCP/IP or PQ-RNS on mesh / LoRa / packet radio / optical.
78 lines
2.1 KiB
Go
78 lines
2.1 KiB
Go
// Copyright (C) 2025-2026, Lux Industries Inc. All rights reserved.
|
|
// See the file LICENSE for licensing terms.
|
|
|
|
// Command pqrnsd is the daemon that serves a PQ-RNS endpoint on one or
|
|
// more interfaces (TCP, LoRa via RNode, AX.25, serial, optical, ...).
|
|
//
|
|
// One and only one binary. No alternate dispatch modes. Subcommands:
|
|
//
|
|
// pqrnsd serve run the daemon
|
|
// pqrnsd announce manually emit a capability-bearing announce
|
|
// pqrnsd dial test link establishment to a destination
|
|
// pqrnsd identity show / rotate the local hybrid identity
|
|
// pqrnsd version
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/spf13/cobra"
|
|
|
|
"github.com/luxfi/pqrns/pkg/identity"
|
|
)
|
|
|
|
func main() {
|
|
root := &cobra.Command{
|
|
Use: "pqrnsd",
|
|
Short: "PQ-RNS — hybrid post-quantum profile for the Reticulum Network Stack",
|
|
}
|
|
|
|
root.AddCommand(
|
|
serveCmd(),
|
|
announceCmd(),
|
|
dialCmd(),
|
|
identityCmd(),
|
|
versionCmd(),
|
|
)
|
|
|
|
if err := root.Execute(); err != nil {
|
|
fmt.Fprintln(os.Stderr, err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
func versionCmd() *cobra.Command {
|
|
return &cobra.Command{
|
|
Use: "version",
|
|
Short: "print PQ-RNS protocol + identity-kind version",
|
|
Run: func(*cobra.Command, []string) {
|
|
fmt.Printf("PQ-RNS-HYBRID-v1 identity_kind=0x%04x pub_id_size=%d\n",
|
|
uint16(identity.KindHybridV1), identity.PublicIdentitySize)
|
|
},
|
|
}
|
|
}
|
|
|
|
func serveCmd() *cobra.Command {
|
|
return &cobra.Command{Use: "serve", Short: "run the PQ-RNS daemon",
|
|
RunE: notImplemented("serve")}
|
|
}
|
|
func announceCmd() *cobra.Command {
|
|
return &cobra.Command{Use: "announce", Short: "emit a capability-bearing announce frame",
|
|
RunE: notImplemented("announce")}
|
|
}
|
|
func dialCmd() *cobra.Command {
|
|
return &cobra.Command{Use: "dial", Short: "test link establishment to a destination",
|
|
RunE: notImplemented("dial")}
|
|
}
|
|
func identityCmd() *cobra.Command {
|
|
return &cobra.Command{Use: "identity", Short: "show / rotate the local hybrid identity",
|
|
RunE: notImplemented("identity")}
|
|
}
|
|
|
|
func notImplemented(name string) func(*cobra.Command, []string) error {
|
|
return func(*cobra.Command, []string) error {
|
|
return fmt.Errorf("%s: not implemented in this initial drop", name)
|
|
}
|
|
}
|