Your network shouldn't depend on another company's login page, central auth server, or closed control plane. Global Ghost Net is an autonomous Rust daemon linking servers, homelabs, and remote devices into a sovereign, erasure-sharded WAN tunnel with RAM-locked post-quantum encryption.
Built for teams and individuals who refuse to route infrastructure secrets through third-party SaaS coordinators or tolerate central points of failure.
Access your internal home subnets, hypervisors, and storage pools from cellular or untrusted hotel Wi-Fi. No port forwarding on your router, no exposing SSH or Web UIs to the public internet, and zero corporate telemetry.
Interconnect multi-region VPS instances and off-site edge servers into a unified peer-to-peer fabric. Nodes discover one another via decentralized signed UDP beacons or custom DNS seeds with automated failover.
Adversaries intercepting internet links see only fixed-width 512-byte datagrams with random trailing jitter. Payloads are fragmented into RS(2,1) shards routed over divergent IP paths; single-path taps capture meaningless noise.
Built from ground up in memory-safe Rust to resist adversary state machines, traffic correlation, and quantum factoring.
Handshakes simultaneously compute classical ECDH (X25519) and lattice-based ML-KEM-512. Session keys are derived through dual-phase HKDF-SHA256, rendering stored network traffic immune to future quantum decryption.
Long-term private keys and ephemeral pre-shared keys are pinned into physical hardware memory via VirtualLock (Windows) and mlock (POSIX). Pages cannot leak to swap or crash dump files.
All Global Tunnel Frames (GTF) are padded to uniform 512-byte boundaries with ChaCha20-Poly1305 AEAD and trailing cryptographically random jitter. Packet sniffers observe no packet length signatures.
Payloads are encoded into Reed-Solomon RS(2,1) GF(256) shards and dynamically routed across disparate mesh paths. Dropped links recover without retransmission as long as two shards arrive.
Mesh nodes model incoming peer timing against expected Poisson arrival distributions. Misbehaving nodes injecting malformed PDUs or replaying counters are quarantined in real-time.
Nodes have no IP-based identity. Every peer is anchored to an Ed25519 public key fingerprint with issuer-signed cryptographic revocation lists. IP roaming preserves authenticated sessions.
Rigorous, fixed-width structure ensuring zero metadata leakage and constant-time parsing verification.
| Offset (Bytes) | Field | Length | Cryptographic / Functional Purpose |
|---|---|---|---|
| 0x00 … 0x03 | Session Token | 4 Bytes | Truncated session identifier, also mixed into the ChaCha20-Poly1305 AEAD nonce to eliminate cross-session collision. |
| 0x04 … 0x07 | Packet Counter | 4 Bytes | Monotonic sequence counter checked against an atomic sliding replay window. Duplicate or late datagrams are rejected in constant time. |
| 0x08 … 0x08 | Shard Index | 1 Byte | Reed-Solomon shard index: 0x00 (Data 0), 0x01 (Data 1), or 0x02 (GF(256) parity shard). |
| 0x09 … 0x09 | Control Flags | 1 Byte | Frame control flags: Bit 0 signals bulk 1472B frames, Bit 1 indicates unordered tunnel datagram routing. |
| 0x0A … 0x1F3 | Encrypted Shard | 486 Bytes | Ciphertext carrying the payload shard, encrypted with ChaCha20 authenticated encryption. |
| 0x1F4 … 0x203 | Poly1305 Tag | 16 Bytes | 128-bit Poly1305 MAC. A single altered bit across header and payload fails constant-time authentication. |
| 0x204 … + | Jitter Padding | 0 – 64 Bytes | Cryptographically random trailing noise injected per-packet to frustrate downstream statistical packet length correlation. |
No account creation, no certificates from third-party CAs. Run directly as a daemon or system service.
Compile from verified Rust source or download the signed static binary onto your exit hub and remote devices:
Generate a 256-bit symmetric pre-shared key. When configured, handshakes will drop unauthorized peers before consuming handshake compute:
Run the node on your home network to bridge traffic to the local subnet:
Replace allowlist with any for open mesh routing among PSK holders. Port 2270 is reserved for UDP discovery beacons.
Connect from cellular or public Wi-Fi directly to your exit hub. All machine traffic routes through the encrypted post-quantum tunnel: