Everything on this page is checkable: the primitives are named, the releases carry their own evidence, the trust boundaries are drawn where they actually are, and the certification items that don’t exist yet say so in plain text.
A two-message authenticated key exchange with identity hiding. Simultaneous initiation resolves by deterministic tie-break — two nodes booting together after a power cut form exactly one session. Stalled handshakes retry at 1 s; unestablished and dynamically-added peers keep a periodic retry loop.
Cryptography is one of the few things an operator is often not free to choose. Identity, handshake, cipher suite and authorization therefore sit behind narrow interfaces: the engine asks for a session and for sealed fragments, and never learns which algorithms answered. Within the Noise framework the primitive set is a parameter of the same handshake — a different key agreement, AEAD or hash is a build-time change — and replacing the handshake framework outright is a bounded integration at the same boundary rather than a fork.
Today: the default build ships the suite above, and the FIPS-validated and post-quantum variants below are specified engineering rather than shipped features. If a national standard, an accreditation regime or an internal policy obliges you to run something else, that is the seam it lands on. The trade is stated plainly: there is no cipher negotiation on the wire by design — one protocol version, one build across the fleet — so a suite is a fleet-wide decision, not a per-session one. The named tracks
The initiator runs a fresh handshake with a new session ID beside the live session; both sides keep the previous keys warm so in-flight packets still decrypt. Measured across rekeys under load: zero packet loss. The rekey marker rides inside the encrypted Noise payload — no wire change; older builds degrade safely. Measured
Anti-replay is checked after AEAD verification against the verifying session’s window — checking earlier would let a stale high nonce poison a fresh window. The same window is what deduplicates broadcast-mode copies.
Decoded private keys live in zeroizing containers wiped on drop; a config file readable beyond its owner produces a load-time warning before anyone ships it that way. A plaintext test mode exists for benchmarking — both peers must explicitly agree, and it says what it is.
Rotation is the moment a tunnel is most likely to drop something — so the sessions overlap. The replacement finishes its handshake and starts carrying while the old one is still sending, and the old one stays warm afterwards so packets already in flight still decrypt. Two triggers run at once: 120 seconds of session age and 1 GiB through the session, whichever arrives first.
A bonded link delivers out of order by construction — three paths, three latencies, one stream. The window has to tell that apart from a replayed capture, and it only gets to look once the packet has already authenticated.
The default and the historical behaviour: if it isn’t in the config, it doesn’t handshake.
A TOML file of public keys and their allowed IPs, re-read on modification — grant or revoke a node by editing one line, no restart, no redeploy. Revocation stops new sessions.
An external command receives the key and source address; exit 0 authorizes and stdout lines become allowed-IP CIDRs. This is the integration point for an external control plane — it’s how the hosted gateways admit app-generated keys with deterministically derived tunnel addresses.
The three providers above are implementations of one small trait, and an embedder can inject any other: your own PKI and certificate chain, an HSM or smartcard, a corporate identity service, an accreditation-mandated enrolment protocol. The module sits beside the data path, not inside it — replacing it changes nothing about the Noise handshake, the scheduler or the wire format.
The point is jurisdictional as much as technical: operators run the authorization scheme they want, or the one their organisation and accreditation oblige them to run, rather than the one a vendor happened to ship. If your programme mandates a specific identity infrastructure, that is an integration, not a fork.
Unreadable keyfile, missing hook, hook timeout, unknown provider — refused start or refused peer, never a silent allow. Providers run off the packet path with a deny cache so a handshake flood can’t fork a process per packet.
The single most important table on this page — because “encrypted” means something different on each row, and your review deserves the difference in writing.
| Path | Who holds keys to the payload | Stated precisely |
|---|---|---|
| Direct peer ↔ peer | The two endpoints only | End-to-end encrypted under the pair’s Noise session. |
| Mesh relay (your fleet) | Every hop on the path | Each leg has its own Noise session: a relay decrypts, makes the forwarding decision, and re-encrypts toward the next hop. Relays are trusted, authenticated members of your own fleet — per-hop protection, not payload blindness. |
| Hosted traversal relay | The two endpoints only | The relay forwards opaque encrypted envelopes addressed by static key; it authenticates clients but holds no key that opens what it forwards. |
Username/password accounts stored beside the daemon (atomic writes, 0600), managed from the CLI. Until users exist, every mutating endpoint answers 403 auth_not_configured — a deliberate lock-down of what used to be an open port.
Enrolling a hardware key upgrades that account to mandatory 2FA — the password alone answers “second factor required” and only the WebAuthn assertion completes login. A break-glass CLI removes a lost key. Changing a fleet’s configuration can demand a hardware key, not just a login.
HMAC-signed HttpOnly sessions, an explicit anti-CSRF header with origin checking, login rate-limiting per IP, same-origin only (the old permissive CORS layer is gone), and optional TLS with a persisted self-signed certificate — required in practice for FIDO2, which needs a secure context and a hostname identity.
Implemented in the release pipeline — every artifact ships with the material a supply-chain review asks for, and a written recipe for verifying it.
The data plane is Rust — the implementation direction recommended by the US ONCD (Feb 2024) and the NSA for security-critical software. The vulnerability classes that have plagued C/C++ tunnel implementations are excluded by construction. Behind it sits a continuously-run automated test estate — unit, integration and full-system — putting real daemons through failover, key rotation under load and configuration rollback on every change.
Every release ships a CycloneDX software bill of materials, and the binaries embed their own dependency manifest (cargo-auditable) — an auditor can interrogate the artifact itself, not just the paperwork beside it.
Keyless Sigstore/cosign signatures — bound to the release pipeline’s own short-lived identity, so there is no long-term signing key to steal — and SLSA Level 3 build provenance: verifiable proof an artifact came from a specific commit on a specific build run. The verification recipe is part of the docs.
Unprivileged user, a single capability (CAP_NET_ADMIN), hardened systemd unit with a seccomp filter, SELinux module (RHEL family) and AppArmor profile (Debian family), and an Ansible role that can chain an OS STIG baseline — one playbook lands a defensible posture.
Wording that stays disciplined: these artifacts support procurement checklists driven by the EU Cyber Resilience Act, NIS2, US EO 14028 and NDAA supply-chain requirements — support, not a compliance declaration.
Three tracks procurement actually asks about — each with its honest “today” line, because a dashed border on a badge is a promise about the label, not the date.
Atlas positions as the inner layer of an NSA CSfC-style two-layer design, beneath a FIPS-validated IPsec or MACsec outer layer. CSfC requires different cipher families, vendors and codebases between layers — the Noise IK / X25519 / ChaCha20 suite is that diversity by design. Positioning, not a listing: Nexus Atlas is not CSfC-listed and does not claim to be.
Track A: a build mode (--crypto=fips) swapping the AEAD/KDF/RNG behind Noise to AWS-LC’s FIPS 140-3-validated module — same protocol, validated primitives. Track B: X25519 + ML-KEM-768 hybrid key exchange in the handshake (--crypto=pq-hybrid) — the construction Cloudflare, Apple and Signal ship — addressing harvest-now-decrypt-later ahead of the CNSA 2.0 timeline. Today: the default build is not FIPS-validated, and the key exchange is classical X25519.
A DDS bridge (via Zenoh) so DDS-based applications — RTI Connext, CycloneDDS, OpenDDS, FastDDS — interoperate over the bonded transport unmodified, keeping FACE-conformant software portable onto degraded links. Today: design stage; the spike is sequenced on integrator demand.
This is the security policy for all of Nexus Atlas: the daemon, the adapters, the console and every one of our domains, whose security.txt files all point back to this section. It is blunt on purpose. We pay nothing, we name nobody, and a finding is most likely never published. What you get instead is an engineer who reads what you sent, tells you whether it is real, and tells you when it is fixed.
Open with the words “security report” — that is what gets it read ahead of the queue rather than in it. We do not print a security mailbox on this site; the form is the route in, and it reaches the same inbox and the same people as everything else. Please keep third-party data, live credentials and anything classified or export-controlled out of what you send — the form asks the same, for the same reason. The contact page
Three things turn a report into a fix. A reproduction — steps, a capture, a config fragment, a few lines of script; anything we can run beats a paragraph describing it. An affected version — the build and the platform you saw it on, because the daemon, the adapters and the websites move on different clocks. What you believe the impact is — what an attacker gains, from what position, and what they must already hold. We may end up disagreeing with your severity; that is a conversation worth having, and a much shorter one when the first two are present.
The Atlas daemon and everything in its data path — handshake and session handling, the replay window, the scheduler, the mesh control plane, the traversal client — together with its operator dashboard and local API. The hardware adapters. The hosted console at console.nexusatlas.net, including node enrolment. And the Nexus Atlas websites themselves: this engineering site, the business site, the traversal service and the app site all publish a security.txt pointing here, because this is the one place the policy lives.
The simulations on this site. Every panel marked Simulation is a model — a drawing of a mechanism driven by invented numbers, with no daemon behind it and no code shared with the product. Driving one into a strange state is a bug in a diagram: there is nothing there to exploit and nothing downstream of it to fix. Tell us anyway if one is visibly broken, but as a defect rather than a vulnerability.
Third-party dependencies belong upstream — report them to the project that maintains the code and send us the advisory identifier, and we will pull the fix through. Social engineering of our people, our suppliers or our users is out of scope. So is anything requiring physical access to a node you do not own: if the hardware is yours, a physical finding is welcome; if it is somebody else’s, it is not yours to test.
Named primitives, verifiable releases, honest boundaries — and the engineers on the call. The artifacts are ready before the meeting is.
