{"slug": "metrice-zero-dependency-post-quantum-p2p-mesh-network", "title": "Metrice: Zero-dependency post-quantum P2P mesh network", "summary": "A developer has released Metrice, a zero-dependency peer-to-peer mesh networking protocol built entirely on Node.js core libraries. The system combines NIST FIPS 203 ML-KEM-768 post-quantum key encapsulation with a Tor-like three-hop onion routing architecture, Ed25519 node identities, and AutoNAT reachability consensus. It also adds Rendezvous reverse tunnels for CGNAT traversal and dynamic CAP_EDGE_TRANSIT role escalation for bridging segmented relays.", "body_md": "Metrice is a decentralized peer-to-peer (P2P) mesh networking protocol engineered with zero external npm dependencies (Zero-Dependency), running natively on Node.js core libraries (`node:crypto`, `node:net`, `node:dgram`, `node:sqlite`, `node:dns`). It features quantum-resistant cryptography (Post-Quantum Cryptography) and a Tor-like multi-hop onion routing architecture.\n\nThe system incorporates NIST FIPS 203 ML-KEM-768 key encapsulation, Ed25519-based RFC 4648 Base32 cryptographic node identities, AutoNAT dialback consensus, Rendezvous persistent reverse tunnels for CGNAT traversal, multi-relay transit bridging (EDGE Transit Routing / `CAP_EDGE_TRANSIT`), Layer 4 HAProxy PROXY Protocol v1 & v2 support, and an embedded in-memory SSH-2 server.\n\n## \n  \n  \n  Architecture & Core Components\n\n### \n  \n  \n  1. Cryptographic Node Identity & Addressing\n\n- Every node maintains a persistent Ed25519 identity key pair.\n- The 16-character Node ID (`NodeID` ) is derived from the first 10 bytes (80 bits) of the SHA-256 digest of the raw Ed25519 public key encoded in RFC 4648 Base32 (`^[a-z2-7]{16}$` ).\n- Network addressing is completely IP/Port agnostic using virtual `.mesh` domain namespaces:  - User Address: `@user:NodeID.mesh`\n  - Federated Channel: `#channel:NodeID.mesh`\n  - Global Mesh Channel: `#genel`\n\n### \n  \n  \n  2. AutoNAT & Reachability Consensus\n\n- Nodes exchange their observed peer addresses (`observedAddress` ) during the cryptographic handshake.\n- A Reflected Public IP consensus is established once at least two independent peers report consistent observations.\n- Nodes initiate reachability testing by transmitting a `DIALBACK_REQUEST` containing a cryptographic nonce.\n- The target peer attempts a TCP dialback connection to the requesting node's physical remote address (`socket.realRemoteAddress || socket.remoteAddress` ). If verified, the node attains the`CAP_RELAY` role; otherwise, it remains in`CAP_EDGE` .\n- \n**SSRF Defense:** Injected`targetIp` values inside`DIALBACK_REQUEST` are strictly discarded; only the verified physical TCP socket remote address is used. Dialbacks targeting RFC 1918 private networks or loopback addresses are blocked.\n\n### \n  \n  \n  3. Rendezvous, CGNAT Reverse Tunnels & Transit Routing (CAP_EDGE_TRANSIT)\n\n- Firewalled or CGNAT-bound `EDGE` nodes establish persistent reverse TCP tunnels to multiple publicly reachable`RELAY` nodes (`maxEdgeRendezvousRelays` , default: 4).\n- Tunnel sessions are authenticated via Ed25519 cryptographic signatures in `RENDEZVOUS_BIND` packets.\n- Firewall session state is preserved through 30-second single-byte keepalives: `0x09` (PING) and`0x0A` (PONG).\n- Active tunnel capacity per relay is bounded to 64 to prevent resource exhaustion (`maxRendezvousTunnels` ).\n- \n**Dynamic Role Escalation (`CAP_EDGE_TRANSIT`):** An EDGE node connected to at least two independent relays with`ALLOW_EDGE_ROUTING=true` dynamically ascends to`CAP_EDGE_TRANSIT` , enabling bidirectional in-and-out reverse tunnel bridging between segmented relays.\n- \n**Loop-Free Gossip Bridging:** Transit edge nodes cross-bridge presence announcements (`PRESENCE_ANNOUNCE` ) and global`#genel` messages between relays without broadcast loops (`ALLOW_EDGE_GOSSIP=true` ).\n\n### \n  \n  \n  4. 3-Hop Telescopic Post-Quantum Onion Routing\n\n- Anonymous 3-hop circuits (Inbound Guard, Relay/Transit, Outbound Exit) conceal network topology and packet trajectories.\n- The circuit selection pool (`relayPool` ) integrates both backbone`RELAY` nodes and`CAP_EDGE_TRANSIT` nodes to enhance routing diversity.\n- Each hop negotiates ephemeral symmetric keys via NIST FIPS 203 ML-KEM-768 (Kyber-768) key encapsulation.\n- \n**Traffic Analysis & DPI Resistance:** All onion cells (`ONION_CELL` ) are padded to a strict uniform length of 2048 bytes (Uniform Cell Padding). Raw payloads are capped at 768 bytes (`MAX_ONION_PAYLOAD` ).\n- Cells are never exposed in plaintext; transport is secured inside AES-256-GCM `ENCRYPTED_FRAME` blocks.\n\n### \n  \n  \n  5. Distributed Presence & SQLite Routing\n\n- Presence and channel subscriptions are propagated across the mesh using Ed25519-signed `PRESENCE_ANNOUNCE` gossip packets.\n- Raw IP addresses are scrubbed from gossip frames; announcements reference only virtual domain names or `.mesh` identifiers.\n- Ephemeral routing entries are cached in memory and committed to the SQLite `routing_table` . Inactive records expire automatically after 60 seconds (TTL).\n\n### \n  \n  \n  6. In-Memory SSH-2 Server & Two-Factor Vault Authentication\n\n- Pure JavaScript SSH-2 server operates natively without requiring external system daemons (`sshd` ).\n- \n**Dynamic Version Synchronisation:** Server identification string (`sshServerVersion` ) dynamically aligns with`package.json` through`src/version.js` (default:`SSH-2.0-Metrice_2.6.0` ) and remains configurable via environment variables.\n- \n**Two-Factor Ephemeral Vault Derivation:** User passwords are salted with the client's Ed25519 public key and derived via Scrypt (N=16384, r=8, p=1) and HKDF-SHA256. Authentication fails without the registered physical Ed25519 key, even if the password is correct.\n\n### \n  \n  \n  7. Layer 4 HAProxy PROXY Protocol v1 & v2 Support\n\n- Nodes operating behind Layer 4 reverse proxies (HAProxy, Nginx Stream, AWS NLB) transparently resolve real client IP addresses and ports (`realRemoteAddress` ,`realRemotePort` ) with`USE_PROXY_PROTOCOL=true` .\n- Supports both US-ASCII text PROXY v1 (`PROXY TCP4/TCP6/UNKNOWN` ) and 12-byte binary magic PROXY v2 with zero external libraries.\n- \n**IP Spoofing Immunity:** Only proxies specified in`PROXY_TRUSTED_IPS` (default:`127.0.0.1,::1` ) are authorized. Unauthorized spoofing attempts are instantly rejected with immediate socket termination (`status: REJECT` ).\n- \n**Transparent Passthrough:** Direct connections without PROXY headers have unparsed bytes restored (`socket.unshift(remainder)` ) and route seamlessly to federation, SSH, or Telnet handlers with zero data loss.\n\nTo see the full installation guide, deployment models, and deployment via Docker, check out the official repository:\n\n**Full Documentation & Source Code:** [https://github.com/GokturkA1/metrice](https://github.com/GokturkA1/metrice)", "url": "https://wpnews.pro/news/metrice-zero-dependency-post-quantum-p2p-mesh-network", "canonical_source": "https://dev.to/gokturka/metrice-zero-dependency-post-quantum-p2p-mesh-network-33ae", "published_at": "2026-09-10 22:06:31+00:00", "updated_at": "2026-09-10 22:47:35.742716+00:00", "lang": "en", "topics": ["ai-infrastructure", "developer-tools"], "entities": ["Metrice", "Node.js", "NIST", "ML-KEM-768", "Ed25519", "Tor", "HAProxy", "SSH-2"], "alternates": {"html": "https://wpnews.pro/news/metrice-zero-dependency-post-quantum-p2p-mesh-network", "markdown": "https://wpnews.pro/news/metrice-zero-dependency-post-quantum-p2p-mesh-network.md", "text": "https://wpnews.pro/news/metrice-zero-dependency-post-quantum-p2p-mesh-network.txt", "jsonld": "https://wpnews.pro/news/metrice-zero-dependency-post-quantum-p2p-mesh-network.jsonld"}}