The following table illustrates the rules for automatically propagating announces from one interface type to another, for all possible combinations. For the purpose of announce propagation, the Full and Gateway modes are identical.

See the Interface Modes section for a conceptual overview of the different interface modes, and how they are configured.

Or, represented in table form:

Reticulum uses a simple suite of efficient, strong and well-tested cryptographic primitives, with widely available implementations that can be used both on general-purpose CPUs and on microcontrollers.

One of the primary considerations for choosing this particular set of primitives is that they can be implemented safely with relatively few pitfalls, on practically all current computing platforms.

The primitives listed here are authoritative. Anything claiming to be Reticulum, but not using these exact primitives is not Reticulum, and possibly an intentionally compromised or weakened clone. The utilised primitives are:

• Ed25519 for signatures

• X25519 for ECDH key exchanges

• HKDF for key derivation

• Encrypted tokens are based on the Fernet spec

• Ephemeral keys derived from an ECDH key exchange on Curve25519

• AES-256 in CBC mode with PKCS7 padding

• HMAC using SHA256 for message authentication

• IVs must be generated through os.urandom() or better

• No Fernet version and timestamp metadata fields

• SHA-256

• SHA-512

In the default installation configuration, the X25519, Ed25519 and AES-256-CBC primitives are provided by OpenSSL (https://www.openssl.org/) (via the PyCA/cryptography (https://github.com/pyca/cryptography) package). The hashing functions SHA-256 and SHA-512 are provided by the standard Python hashlib (https://docs.python.org/3/library/hashlib.html). The HKDF, HMAC, Token primitives, and the PKCS7 padding function are always provided by the following internal implementations:

• RNS/Cryptography/HKDF.py

• RNS/Cryptography/HMAC.py

• RNS/Cryptography/Token.py

• RNS/Cryptography/PKCS7.py

Reticulum also includes a complete implementation of all necessary primitives in pure Python. If OpenSSL & PyCA are not available on the system when Reticulum is started, Reticulum will instead use the internal pure-python primitives. A trivial consequence of this is performance, with the OpenSSL backend being much faster. The most important consequence however, is the potential loss of security by using primitives that has not seen the same amount of scrutiny, testing and review as those from OpenSSL.

Using the normal RNS installation procedures, it is not possible to install Reticulum on a system without the required OpenSSL primitives being available, and if they are not, they will be resolved and installed as a dependency. It is only possible to use the pure-python primitives by manually specifying this, for example by using the rnspure package.

If you want to use the internal pure-python primitives, it is highly advisable that you have a good understanding of the risks that this pose, and make an informed decision on whether those risks are acceptable to you.