Interface Access Code
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Manual: Interface Access Codes ↗
Note: IFAC only controls access to an interface, it does not create an isolated network per se. A packet received through a transport node's IFAC-enabled interface may be stripped of its IFAC and deobfuscated before being routed to other interfaces. This also applies to announces; nodes on the wider network may be able to reach a destination announced on an IFAC-enabled interface.
Contents
How it works
An IFAC-enabled interface derives a shared Ed25519 signing identity from its network name and/or passphrase. It uses this to sign each outbound packet and XOR-mask its headers (except the IFAC itself) and payload using HKDF. On receipt, the interface unmasks the packet, verifies the IFAC and drops any packet with an invalid signature, ensuring only traffic with the correct network name and/or passphrase gets through.cite-ref-2[2]
Configuration
To enable IFAC, add either or both of these options to the interface definition:
• network_name – The virtual network name
• passphrase – Authentication passphrase
Discoverable interfaces can publish IFAC credentials with publish_ifac = true. Unless the network is intended to be public, this should be paired with a network identity and discovery_encrypt = true.
It is also possible to specify a custom IFAC length in bits (8–512) with ifac_size, but this should not be changed in normal use.
References
Reticulum concepts
Announce • Blackhole • Buffer • Channel • Destination • Discovery • Identity • Instance • Interface • Interface Access Code (IFAC) • Link • Network identity • Node • Packet • Path • Propagation node • Resource • Stamp • Transport node