Package: rns
Reticulum Network Stack βReticulum is the cryptography-based networking stack for building local and wide-area
networks with readily available hardware. It can operate even with very high latency
and extremely low bandwidth. Reticulum allows you to build wide-area networks
with off-the-shelf tools, and offers end-to-end encryption and connectivity,
initiator anonymity, autoconfiguring cryptographically backed multi-hop
transport, efficient addressing, unforgeable delivery acknowledgements and
more.The vision of Reticulum is to allow anyone to be their own network operator,
and to make it cheap and easy to cover vast areas with a myriad of independent,
inter-connectable and autonomous networks. Reticulumis notonenetwork.
It isa toolfor buildingthousands of networks. Networks without
kill-switches, surveillance, censorship and control. Networks that can freely
interoperate, associate and disassociate with each other, and require no
central oversight. Networks for human beings.Networks for the people.Reticulum is a complete networking stack, and does not rely on IP or higher
layers, but it is possible to use IP as the underlying carrier for Reticulum.
It is therefore trivial to tunnel Reticulum over the Internet or private IP
networks.Having no dependencies on traditional networking stacks frees up overhead that
has been used to implement a networking stack built directly on cryptographic
principles, allowing resilience and stable functionality, even in open and
trustless networks.No kernel modules or drivers are required. Reticulum runs completely in
userland, and can run on practically any system that runs Python 3.Read The ManualThe full documentation for Reticulum is available atmarkqvist.github.io/Reticulum/manual/.You can also download theReticulum manual as a PDForas an e-book in EPUB format.For more info, seereticulum.networkNotable FeaturesCoordination-less globally unique addressing and identificationFully self-configuring multi-hop routingInitiator anonymity, communicate without revealing your identityAsymmetric X25519 encryption and Ed25519 signatures as a basis for all communicationForward Secrecy with ephemeral Elliptic Curve Diffie-Hellman keys on Curve25519Reticulum uses the following format for encrypted tokens:Keys are ephemeral and derived from an ECDH key exchange on Curve25519AES-128 in CBC mode with PKCS7 paddingHMAC using SHA256 for authenticationIVs are generated through os.urandom()Unforgeable packet delivery confirmationsA variety of supported interface typesAn intuitive and easy-to-use APIReliable and efficient transfer of arbitrary amounts of dataReticulum can handle a few bytes of data or files of many gigabytesSequencing, transfer coordination and checksumming are automaticThe API is very easy to use, and provides transfer progressLightweight, flexible and expandable Request/Response mechanismEfficient link establishmentTotal cost of setting up an encrypted and verified link is only 3 packets, totalling 297 bytesLow cost of keeping links open at only 0.44 bits per secondReliable sequential delivery with Channel and Buffer mechanismsRoadmapWhile Reticulum is already a fully featured and functional networking stack,
many improvements and additions are actively being worked on, and planned for the future.To learn more about the direction and future of Reticulum, please see theDevelopment Roadmap.Examples of Reticulum ApplicationsIf you want to quickly get an idea of what Reticulum can do, take a look at the
following resources.You can use thernshprogram to establish remote shell sessions over Reticulum.For an off-grid, encrypted and resilient mesh communications platform, seeNomad NetworkThe Android, Linux and macOS appSidebandhas a graphical interface and focuses on ease of use.LXMFis a distributed, delay and disruption tolerant message transfer protocol built on ReticulumWhere can Reticulum be used?Over practically any medium that can support at least a half-duplex channel
with greater throughput than 5 bits per second, and an MTU of 500 bytes. Data radios,
modems, LoRa radios, serial lines, AX.25 TNCs, amateur radio digital modes,
WiFi and Ethernet devices, free-space optical links, and similar systems are
all examples of the types of physical devices Reticulum can use.An open-source LoRa-based interface calledRNodehas
been designed specifically for use with Reticulum. It is possible to build
yourself, or it can be purchased as a complete transceiver that just needs a
USB connection to the host.Reticulum can also be encapsulated over existing IP networks, so there's
nothing stopping you from using it over wired Ethernet, your local WiFi network
or the Internet, where it'll work just as well. In fact, one of the strengths
of Reticulum is how easily it allows you to connect different mediums into a
self-configuring, resilient and encrypted mesh, using any available mixture of
available infrastructure.As an example, it's possible to set up a Raspberry Pi connected to both a LoRa
radio, a packet radio TNC and a WiFi network. Once the interfaces are
configured, Reticulum will take care of the rest, and any device on the WiFi
network can communicate with nodes on the LoRa and packet radio sides of the
network, and vice versa.How do I get started?The best way to get started with the Reticulum Network Stack depends on what
you want to do. For full details and examples, have a look at theGetting Started Fastsection of theReticulum Manual.To simply install Reticulum and related utilities on your system, the easiest way is viapip.
You can then start any program that uses Reticulum, or start Reticulum as a system service withthe rnsd utility.pipinstallrnsIf you are using an operating system that blocks normal user package installation viapip,
you can returnpipto normal behaviour by editing the~/.config/pip/pip.conffile,
and adding the following directive in the[global]section:[global]
break-system-packages = trueAlternatively, you can use thepipxtool to install Reticulum in an isolated environment:pipxinstallrnsWhen first started, Reticulum will create a default configuration file,
providing basic connectivity to other Reticulum peers that might be locally
reachable. The default config file contains a few examples, and references for
creating a more complex configuration.If you have an old version ofpipon your system, you may need to upgrade it first withpip install pip --upgrade. If you no not already havepipinstalled, you can install it using the package manager of your system withsudo apt install python3-pipor similar.For more detailed examples on how to expand communication over many mediums such
as packet radio or LoRa, serial ports, or over fast IP links and the Internet using
the UDP and TCP interfaces, take a look at theSupported Interfacessection of theReticulum Manual.Included UtilitiesReticulum includes a range of useful utilities for managing your networks,
viewing status and information, and other tasks. You can read more about these
programs in theIncluded Utility Programssection of theReticulum Manual.The system daemonrnsdfor running Reticulum as an always-available serviceAn interface status utility calledrnstatus, that displays information about interfacesThe path lookup and management toolrnpathletting you view and modify path tablesA diagnostics tool calledrnprobefor checking connectivity to destinationsA simple file transfer program calledrncpmaking it easy to transfer files between systemsThe identity management and encryption utilityrnidlet's you manage Identities and encrypt/decrypt filesThe remote command execution programrnxlet's you run commands and
programs and retrieve output from remote systemsAll tools, includingrnxandrncp, work reliably and well even over very
low-bandwidth links like LoRa or Packet Radio. For full-featured remote shells
over Reticulum, also have a look at thernshprogram.Supported interface types and devicesReticulum implements a range of generalised interface types that covers most of
the communications hardware that Reticulum can run over. If your hardware is
not supported, it's relatively simple to implement an interface class. I will
gratefully accept pull requests for custom interfaces if they are generally
useful.Currently, the following interfaces are supported:Any Ethernet deviceLoRa usingRNodePacket Radio TNCs (with or without AX.25)KISS-compatible hardware and software modemsAny device with a serial portTCP over IP networksUDP over IP networksExternal programs via stdio or pipesCustom hardware via stdio or pipesPerformanceReticulum targets averywide usable performance envelope, but prioritises
functionality and performance on low-bandwidth mediums. The goal is to
provide a dynamic performance envelope from 250 bits per second, to 1 gigabit
per second on normal hardware.Currently, the usable performance envelope is approximately 150 bits per second
to 40 megabits per second, with physical mediums faster than that not being
saturated. Performance beyond the current level is intended for future
upgrades, but not highly prioritised at this point in time.Current StatusReticulum should currently be considered beta software. All core protocol
features are implemented and functioning, but additions will probably occur as
real-world use is explored. There will be bugs. The API and wire-format can be
considered relatively stable at the moment, but could change if warranted.DependenciesThe installation of the defaultrnspackage requires the dependencies listed
below. Almost all systems and distributions have readily available packages for
these dependencies, and when thernspackage is installed withpip, they
will be downloaded and installed as well.PyCA/cryptographypyserialOn more unusual systems, and in some rare cases, it might not be possible to
install or even compile one or more of the above modules. In such situations,
you can use thernspurepackage instead, which require no external
dependencies for installation. Please note that the contents of thernsandrnspurepackages areidentical. The only difference is that thernspurepackage lists no dependencies required for installation.No matter how Reticulum is installed and started, it will load external
dependencies only if they areneededandavailable. If for example you want
to use Reticulum on a system that cannot supportpyserial, it is perfectly possible to
do so using thernspurepackage, but Reticulum will not be able to use
serial-based interfaces. All other available modules will still be loaded when
needed.Please Note!If you use thernspurepackage to run Reticulum on systems
that do not supportPyCA/cryptography,
it is important that you read and understand theCryptographic
Primitivessection of this document.Public TestnetIf you just want to get started experimenting without building any physical
networks, you are welcome to join the Unsigned.io RNS Testnet. The testnet is
just that, an informal network for testing and experimenting. It will be up
most of the time, and anyone can join, but it also means that there's no
guarantees for service availability.The testnet runs the very latest version of Reticulum (often even a short while
before it is publicly released). Sometimes experimental versions of Reticulum
might be deployed to nodes on the testnet, which means strange behaviour might
occur. If none of that scares you, you can join the testnet via either TCP or
I2P. Just add one of the following interfaces to your Reticulum configuration
file:# TCP/IP interface to the RNS Amsterdam Hub
  [[RNS Testnet Amsterdam]]
    type = TCPClientInterface
    enabled = yes
    target_host = amsterdam.connect.reticulum.network
    target_port = 4965

# TCP/IP interface to the BetweenTheBorders Hub (community-provided)
  [[RNS Testnet BetweenTheBorders]]
    type = TCPClientInterface
    enabled = yes
    target_host = betweentheborders.com
    target_port = 4242

# Interface to Testnet I2P Hub
  [[RNS Testnet I2P Hub]]
    type = I2PInterface
    enabled = yes
    peers = g3br23bvx3lq5uddcsjii74xgmn6y5q325ovrkq2zw2wbzbqgbuq.b32.i2pThe testnet also contains a number ofNomad Networknodes, and LXMF propagation nodes.Support ReticulumYou can help support the continued development of open, free and private communications systems by donating via one of the following channels:Monero:84FpY1QbxHcgdseePYNmhTHcrgMX4nFfBYtz2GKYToqHVVhJp8Eaw1Z1EedRnKD19b3B8NiLCGVxzKV17UMmmeEsCrPyA5wEthereum0x81F7B979fEa6134bA9FD5c701b3501A2e61E897aBitcoin3CPmacGm34qYvR6XWLVEJmi2aNe3PZqUuqKo-Fi:https://ko-fi.com/markqvistAre certain features in the development roadmap are important to you or your
organisation? Make them a reality quickly by sponsoring their implementation.Cryptographic PrimitivesReticulum uses a simple suite of efficient, strong and modern cryptographic
primitives, with widely available implementations that can be used both on
general-purpose CPUs and on microcontrollers. The necessary primitives are:Ed25519 for signaturesX22519 for ECDH key exchangesHKDF for key derivationModified Fernet for encrypted tokensAES-128 in CBC modeHMAC for message authenticationNo Fernet version and timestamp fieldsSHA-256SHA-512In the default installation configuration, theX25519,Ed25519andAES-128-CBCprimitives are provided byOpenSSL(via thePyCA/cryptographypackage).
The hashing functionsSHA-256andSHA-512are provided by the standard
Pythonhashlib. TheHKDF,HMAC,Fernetprimitives, and thePKCS7padding function are always
provided by the following internal implementations:HKDF.pyHMAC.pyFernet.pyPKCS7.pyReticulum also includes a complete implementation of all necessary primitives
in pure Python. If OpenSSL & PyCA are not available on the system when
Reticulum is started, Reticulum will instead use the internal pure-python
primitives. A trivial consequence of this is performance, with the OpenSSL
backend beingmuchfaster. The most important consequence however, is the
potential loss of security by using primitives that has not seen the same
amount of scrutiny, testing and review as those from OpenSSL.If you want to use the internal pure-python primitives, it ishighly
advisablethat you have a good understanding of the risks that this pose, and
make an informed decision on whether those risks are acceptable to you.Reticulum is relatively young software, and should be considered as such. While
it has been built with cryptography best-practices very foremost in mind, ithas notbeen externally security audited, and there could very well be
privacy or security breaking bugs. If you want to help out, or help sponsor an
audit, please do get in touch.Acknowledgements & CreditsReticulum can only exist because of the mountain of Open Source work it was
built on top of, the contributions of everyone involved, and everyone that has
supported the project through the years. To everyone who has helped, thank you
so much.A number of other modules and projects are either part of, or used by
Reticulum. Sincere thanks to the authors and contributors of the following
projects:PyCA/cryptography,BSD LicensePure-25519byBrian Warner,MIT LicensePysha2byThom Dixon,MIT LicensePython-AESbyOr Gur Arie,MIT LicenseCurve25519.pybyNicko van Someren,Public DomainI2PlibbyViktor VillainovPySerialby Chris Liechti,BSD LicenseConfigobjby Michael Foord, Nicola Larosa, Rob Dennis & Eli Courtwright,BSD LicenseSixbyBenjamin Peterson,MIT LicenseifaddrbyPydron,MIT LicenseUmsgpack.pybyIvan A. SergeevPython