# Show HN: Latch – Lightweight hybrid post-quantum proxy (X25519M-KEM-768)

> Source: <https://github.com/itsVentie/Latch>
> Published: 2026-07-16 17:13:06+00:00

A lightweight, high-performance infrastructure proxy server engineered to secure legacy TCP traffic against interception and future quantum cryptanalysis (Shor's algorithm).

**Session Resumption (Fast Reconnect):** Integrated a stateful, secure session-resumption layer (using`SessionStore`

and AES-GCM Ticket encryption). Clients can now bypass heavy ML-KEM math on reconnect, establishing secure transport in a fraction of the time.**Mutual TLS (mTLS) Transport:** Replaced legacy symmetric pre-shared secrets with a robust, asymmetric Mutual TLS layer. Nodes are verified via an X.509 Public Key Infrastructure (PKI) prior to executing post-quantum handshakes.**Asynchronous Handshake Architecture:** Moved server-side TLS handshakes into a concurrent worker pool context to keep the primary`Accept`

loop unblocked, completely eliminating socket read reset errors (`wsarecv`

).**Cross-Platform Automation Pipeline:** Upgraded the testing suite.`test.ps1`

(Windows) and`test.sh`

(Linux/macOS) now automatically perform formatting, module tidying, linter checks, fuzzing, race detection, and cross-compile optimized binaries directly into`./dist/`

.**Zero-Allocation Data Path:** Guaranteed raw performance (**0 B/op**,** 0 allocs/op**) across the core`proxyPipe`

routing layer via structured`sync.Pool`

byte-buffer recycling.

`Latch`

establishes a multi-layered security perimeter:

**Network Authentication (mTLS):** A standard TLS 1.3 handshake authenticates both endpoints. Unauthorized packets are dropped immediately, shielding expensive post-quantum mathematical calculations from unauthorized clients.**Hybrid Post-Quantum Core:** Upon successful transport authorization, an ephemeral**X25519**(classical ECDH) and** ML-KEM-768**(NIST FIPS 203 quantum-resistant KEM) hybrid exchange executes. A 256-bit master key is derived via HKDF-SHA256.** Payload Encryption:**Packets are encapsulated inside custom binary frames and encrypted using** ChaCha20-Poly1305**authenticated encryption (AEAD).

``` php
[Client App] -> (Local:3000) -> [Latch Client] -> (mTLS + PQC Tunnel) -> [Latch Server] -> (Target:8000) -> [Backend App]
./latch -mode server -listen :9090 -target 127.0.0.1:8000
./latch -mode client -listen :3000 -target 127.0.0.1:9090
```

Note: Valid client/server certificates and root CA bundles must be properly bound to your environment's cryptographic configurations.

Run the full pipeline (static code analysis, fuzzing, race detection, and localized artifact compilation for Windows, Linux, and macOS):

```
.\test.ps1
chmod +x test.sh
./test.sh
go test -run=^$ -bench=BenchmarkProxyPipe -benchmem ./internal/network/tests/...
go test -fuzz=FuzzSecureConnRead -fuzztime=10s ./internal/crypto
```

To achieve maximum throughput, zero garbage collector overhead, and ultra-low latency under high packet rates (especially for UDP traffic), `Latch`

is moving toward a **Control Plane / Data Plane separation** model.

```
                           +------------------------+
                           |   Latch Go-Control     |  <-- Config, mTLS,
                           |   (Management Plane)   |      PQC Handshake
                           +------------------------+
                                       |
                                       | Sends session key & remote details
                                       v (via Unix Socket / Named Pipe)
+----------------+         +------------------------+         +----------------+
|  Local Client  |  <--->  |  Latch Rust Dataplane  |  <--->  | Remote Server  |
|  (TCP / UDP)   |         | (High-Speed Data Path) |         |  (Encrypted)   |
+----------------+         +------------------------+         +----------------+
                             * Zero-Copy Ring Buffers
                             * Tokio Async Runtime
                             * AEAD Crypto in Rust
```

**Control Plane (Go):** Handles the configuration, standard mTLS handshake, PQC hybrid key exchange, and session resumption management. Once a connection is authorized and keys are agreed upon, Go passes the active context down to the fast path.**Data Plane (Rust):** A dedicated, highly-optimized daemon processes the actual TCP/UDP streams. It receives the session keys over a local Unix domain socket (or Windows named pipe), opening high-speed, zero-copy sockets for raw packet forwarding and fast AEAD encryption.

- Hybrid Key Exchange (X25519 + ML-KEM-768)
- Structured Production Logging via
`log/slog`

- Zero-Allocation Network Pipeline (
`sync.Pool`

) - Certificate-based Authentication / Mutual TLS (mTLS)
- Automated Multi-OS Build Pipeline (
`/dist`

for Windows, Linux, macOS) - Native Go Fuzzing for custom frame parsing
- Session Resumption (Fast Reconnect) for Hybrid Handshakes
-
**Next:** Split-Process Fast-Path Data Plane (Rust acceleration) - UDP Encapsulation / Tunneling Mode
- Transparent proxying (TPROXY) and iptables redirection support