A self-organizing Rust daemon establishing quantum-resistant LAN-over-WAN tunnels. Zero centralized coordinators, zero telemetry, and zero single points of failure.
Traffic is fragmented into Reed-Solomon RS(2,1) shards dispersed across worldwide peers. Every participant increases routing entropy — rendering censorship and single-hop wiretapping mathematically impossible.
Enforces a 256-bit symmetric pre-shared key. Cryptographically isolates your mesh exclusively to your authorized nodes, dropping unauthorized packets before consuming CPU cycles.
Engineered for distributed infrastructure, adversarial network environments, and teams that refuse third-party coordination planes.
Interconnect distributed VPS instances, bare-metal servers, and edge nodes into a resilient L2/L3 overlay. Nodes discover peers autonomously via signed UDP multicasts and decentralized DNS round-robins with zero reliance on vendor infrastructure.
Bypass deep packet inspection firewalls and state-sponsored Internet blockades. Payloads are divided into RS(2,1) shards dispatched concurrently across divergent IP paths; eavesdroppers at single transit taps observe only indecipherable random noise.
Protect critical communications against "Harvest Now, Decrypt Later" adversaries with dual-layer ML-KEM-512 and X25519 key encapsulation. Master secrets are pinned into non-swappable physical RAM with volatile zeroization on drop.
Built from ground up in memory-safe Rust to resist adversary state machines, traffic correlation, and quantum factoring.
Handshakes compute classical ECDH (X25519) and lattice-based ML-KEM-512 (FIPS 203) in tandem. Dual-phase HKDF-SHA256 derivation renders transit streams completely immune to quantum cryptanalysis.
Long-term private keys and ephemeral pre-shared secrets are pinned into non-pageable memory via VirtualLock (Windows) and mlock (POSIX), preventing page eviction to swap or crash dump files.
Ghost Transport Frames (GTF) maintain strict 512-byte boundaries with ChaCha20-Poly1305 AEAD and trailing cryptographic jitter padding (0–64 bytes), depriving passive observers of payload size fingerprints.
Stream payloads are segmented into Reed-Solomon RS(2,1) GF(256) shards routed across distinct peer paths. As long as any 2 of the 3 shards arrive, packets reconstruct instantaneously with zero retransmission delay.
Nodes benchmark peer timing against expected Poisson inter-arrival models. Peers attempting out-of-order injection, replay window tampering, or malformed PDU floods are instantly isolated.
Nodes possess no fixed IP addresses. Identity is permanently anchored to Ed25519 public key fingerprints with issuer-signed cryptographic revocation lists, maintaining authentication across dynamic IP roaming.
Rigorous, fixed-width structure ensuring zero metadata leakage and constant-time parsing verification.
| Offset (Bytes) | Field | Length | Cryptographic / Functional Purpose |
|---|---|---|---|
| 0x00 … 0x03 | Session Token | 4 Bytes | Truncated session identifier, also mixed into the ChaCha20-Poly1305 AEAD nonce to eliminate cross-session collision. |
| 0x04 … 0x07 | Packet Counter | 4 Bytes | Monotonic sequence counter checked against an atomic sliding replay window. Duplicate or late datagrams are rejected in constant time. |
| 0x08 … 0x08 | Shard Index | 1 Byte | Reed-Solomon shard index: 0x00 (Data 0), 0x01 (Data 1), or 0x02 (GF(256) parity shard). |
| 0x09 … 0x09 | Control Flags | 1 Byte | Frame control flags: Bit 0 signals bulk 1472B frames, Bit 1 indicates unordered tunnel datagram routing. |
| 0x0A … 0x1F3 | Encrypted Shard | 486 Bytes | Ciphertext carrying the payload shard, encrypted with ChaCha20 authenticated encryption. |
| 0x1F4 … 0x203 | Poly1305 Tag | 16 Bytes | 128-bit Poly1305 MAC. A single altered bit across header and payload fails constant-time authentication. |
| 0x204 … + | Jitter Padding | 0 – 64 Bytes | Cryptographically random trailing noise injected per-packet to frustrate downstream statistical packet length correlation. |
A 7-node carrier simulation environment replicating transcontinental WAN conditions with Linux kernel tc netem latency, jitter, packet loss, and Byzantine adversaries.
Traffic traverses multi-hop carrier networks where intermediary nodes parse explicit hop headers ([hops_remaining][next_ip][next_port]) without inspecting inner encrypted payloads. Corrupted, delayed, or severed carrier links are autonomously isolated and bypassed.
Intermediary Carrier 2 injects 4-byte corruptions into in-flight payloads. Combinatorial pairwise RS(2,1) evaluation detects Poly1305 MAC failures, isolates the rogue carrier, and recovers pristine data.
Adversarial replay injections of duplicate frames with stale sequence counters are evaluated against SessionGuard. Bitmask inspection drops replayed datagrams before reaching decryption buffers.
Frames are dynamically encapsulated with 16 to 64 bytes of cryptographically randomized trailing jitter padding. Variable wire footprints frustrate deep packet inspection (DPI) and timing correlation.
Chaos Monkey severs the primary Satellite carrier link every 5 of 10 cycles. AdaptiveShardRouter detects loss and dynamically reroutes shards through hot standby Carrier 5 with zero stream drops.
No central account creation, no external coordinator dependencies, and zero CA trusts. Run directly as a native system daemon.
Global Ghost Net is self-contained with zero runtime dependencies. Install via Cargo or fetch the pre-compiled static binary:
Binds UDP mesh listener and automatically discovers global participants via decentralized DNS seeds and LAN multicast:
Port 2271 handles encrypted GTF datagrams; port 2270 handles local Ed25519-signed multicast beacons.
Generate a 256-bit symmetric pre-shared key. Packets without a valid cryptographic PSK tag are dropped prior to decapsulation:
Tunnel application traffic through the encrypted post-quantum mesh directly to designated exit nodes or peer subnets:
Spin up the 7-node carrier mesh under Linux tc netem with live Web Dashboard and SOCKS5 proxy:
Exports dashboard on :8080 (HTML and /api/telemetry) and mesh client SOCKS5 proxy on :1080.
