Communication over untrusted networks.
Kamune provides Ed25519_MLKEM768_ChaCha20-Poly1305X security suite.
Note
This is an experimental project. All suggestions and feedback are welcome and greatly appreciated.
- Message signing and verification using Ed25519
- Encrypted handshake using HPKE (RFC 9180)
- Ephemeral, quantum-resistant key encapsulation with ML-KEM-768, providing Forward secrecy.
- End-to-End, bidirectional symmetric encryption using ChaCha20-Poly1305X
- Key derivation via HKDF-SHA512 (HMAC-based extract-and-expand)
- Lightweight, custom protocol implemented in both TCP and UDP for minimal overhead and latency
- Real-time, instant messaging over socket-based connection
- Direct peer-to-peer communication, with optional relay fallback
- Protobuf for fast, compact binary message encoding
| Directory | Purpose | Description |
|---|---|---|
. (root) |
Core library | Protocol, transport, cipher suite, session management, router, and storage abstraction |
cmd/bus/ |
Desktop GUI client | Wails + Svelte desktop app with relay transport UI, session management, and encrypted history |
cmd/relay/ |
Relay server | Stateless blind relay that routes encrypted sessions between peers without decrypting traffic — supports WebSocket, TCP, and TLS |
cmd/daemon/ |
JSON-over-stdio daemon | Headless IPC wrapper for integrating kamune into external applications |
cmd/tui/ |
Terminal chat client | Interactive Bubble Tea TUI with direct TCP, relay, peer verification (emoji/hex fingerprint), and chat history browsing |
- Application-level ping/pong keep-alive
- Client-side minor version warning — surface the core warning to users in clients
- Generate connection QR code in clients
- OS keychain integration (replace env var passphrase)
- Session resumption — reconnect without full re-handshake
- Chunked reads/writes for large messages
- Key rotation
- NAT traversal / hole punching
- Custom encoding protocol (replace Protobuf)
- QUIC, WebRTC, or other transport protocols
- Messaging Layer Security (MLS) / group chats
- Android/iOS native applications
Communication happens in three phases:
- Exchange — Parties agree on an HPKE shared secret to encrypt the handshake.
- Handshake — Ephemeral ML-KEM-768 key exchange, session ID derivation, and mutual challenge-response verification.
- Communication — Signed, encrypted, and sequenced message frames with replay protection.
For a comprehensive technical specification, see SPEC.md.