After exploring the basics of the announce mechanism, finding a path through the network, and an overview of the link establishment procedure, this section will go into greater detail about the Reticulum link establishment process.

The link in Reticulum terminology should not be viewed as a direct node-to-node link on the physical layer, but as an abstract channel, that can be open for any amount of time, and can span an arbitrary number of hops, where information will be exchanged between two nodes.

When a node in the network wants to establish verified connectivity with another node, it will randomly generate a new X25519 private/public key pair. It then creates a link request packet, and broadcast it.

It should be noted that the X25519 public/private keypair mentioned above is two separate keypairs: An encryption key pair, used for derivation of a shared symmetric key, and a signing key pair, used for signing and verifying messages on the link. They are sent together over the wire, and can be considered as single public key for simplicity in this explanation.

The link request is addressed to the destination hash of the desired destination, and contains the following data: The newly generated X25519 public key LKi.

The broadcasted packet will be directed through the network according to the rules laid out previously.

Any node that forwards the link request will store a link id in it’s link table , along with the amount of hops the packet had taken when received. The link id is a hash of the entire link request packet. If the link request packet is not proven by the addressed destination within some set amount of time, the entry will be dropped from the link table again.

When the destination receives the link request packet, it will decide whether to accept the request. If it is accepted, the destination will also generate a new X25519 private/public key pair, and perform a Diffie Hellman Key Exchange, deriving a new symmetric key that will be used to encrypt the channel, once it has been established.

A link proof packet is now constructed and transmitted over the network. This packet is addressed to the link id of the link. It contains the following data: The newly generated X25519 public key LKr and an Ed25519 signature of the link id and LKr made by the signing key of the addressed destination.

By verifying this link proof packet, all nodes that originally transported the link request packet to the destination from the originator can now verify that the intended destination received the request and accepted it, and that the path they chose for forwarding the request was valid. In sucessfully carrying out this verification, the transporting nodes marks the link as active. An abstract bi-directional communication channel has now been established along a path in the network.

When the source receives the proof , it will know unequivocally that a verified path has been established to the destination. It can now also use the X25519 public key contained in the link proof to perform it’s own Diffie Hellman Key Exchange and derive the symmetric key that is used to encrypt the channel. Information can now be exchanged reliably and securely.

It’s important to note that this methodology ensures that the source of the request does not need to reveal any identifying information about itself. The link initiator remains completely anonymous.

When using links, Reticulum will automatically verify all data sent over the link, and can also automate retransmissions if Resources are used.

THIS IS A PART OF THE

Back to the Node Startpage