laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-07-22 07:48:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update docs for persistent identity, ECN, and multi-transport

Browse Source 
- fips-configuration.md: add node.identity.persistent parameter and
  three-tier identity resolution documentation
- fips-intro.md: update ECN description from "reserves space" to
  reflect implemented hop-by-hop CE signaling
- README.md: update transport list (UDP, TCP, Ethernet), add
  persistent identity mention
This commit is contained in:
Johnathan Corgan
2026-03-06 21:20:16 +00:00
parent e99654d464
commit 79feb41a88
3 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
docs/design/fips-configuration.md
View File

@@ -70,7 +70,19 @@ handle infrastructure concerns only.
| Parameter | Type | Default | Description |
|-----------|------|---------|-------------|
| `node.identity.nsec` | string | *(generate random)* | Hex-encoded secret key. If omitted, an ephemeral identity is generated on each start. |
| `node.identity.nsec` | string | *(none)* | Secret key in nsec (bech32) or hex format. If omitted, behavior depends on `persistent`. |
| `node.identity.persistent` | bool | `false` | Persist identity across restarts via key file. |
Identity resolution follows a three-tier priority:
1. **Explicit `nsec`** in config — always used when present, regardless of `persistent`
2. **Persistent key file** — when `persistent: true` and no `nsec`, loads from `fips.key`
adjacent to the config file; if no key file exists, generates a new keypair and saves it
3. **Ephemeral** — when `persistent: false` (default) and no `nsec`, generates a fresh
keypair on each start
Key files (`fips.key` with mode 0600, `fips.pub` with mode 0644) are written adjacent
to the highest-priority config file for operator visibility, even in ephemeral mode.
### General
@@ -442,7 +454,8 @@ The full YAML structure with all defaults:
```yaml
node:
identity:
nsec: null # hex secret key (null = generate ephemeral)
nsec: null # secret key in nsec or hex (null = depends on persistent)
persistent: false # true = load/save fips.key; false = ephemeral each start
leaf_only: false
tick_interval_secs: 1
base_rtt_ms: 100

7
docs/design/fips-intro.md
View File

@@ -739,9 +739,12 @@ for wireless mesh routing and is used in protocols including
and [Babel](https://www.irif.fr/~jch/software/babel/). FIPS computes ETX
per-link from MMP loss measurements for future use in candidate ranking.
The CE (Congestion Experienced) echo flag reserves space for
The CE (Congestion Experienced) echo flag provides hop-by-hop
[ECN](https://en.wikipedia.org/wiki/Explicit_Congestion_Notification)
signaling, following the TCP/IP ECN echo pattern (RFC 3168).
signaling, following the TCP/IP ECN echo pattern (RFC 3168). Transit nodes
detect congestion via MMP loss/ETX metrics or kernel buffer drops and set
the CE flag on forwarded frames; destination nodes mark ECN-capable IPv6
packets accordingly.
### Cryptographic Primitives