Zaycomm

The Problem

• When the network is down, congested, or unaffordable, devices sitting physically next to each other still cannot talk to one another.
• Mesh projects usually start with code, which makes the security properties an accident of the implementation instead of a design decision.

The Solution

• Wrote ten RFCs before implementation: project constitution, threat model, protocol overview, cryptographic architecture, identity architecture, packet specification, routing algorithm, transport layer, storage layer, and reference architecture.
• Built the cryptographic core from named primitives: X25519 and Ed25519 for key agreement and identity, a Noise IK handshake for session establishment, and a Double Ratchet for message keys, so a compromised key does not expose past or future messages.
• Wrote native Bluetooth Low Energy transports for Android and iOS, with Wi-Fi Direct and internet as additional transports, so the same protocol runs over whatever medium is actually available.
• Wrote the test suite against the protocol's own attack surface rather than only the happy path.

The Result

• Ten RFCs covering the full protocol surface, plus 33 TypeScript source files and a test suite of 46 files.
• Derived every identity and session key in the reference implementation from the primitives specified in RFC-0004 rather than inventing a scheme.
• Released as v1.0 under the MIT licence, so both the specification and the implementation can be reused.

What this does not claim

• The artefact is the specification, the implementation and the tests. There is no production network, no deployment at scale and no user base to claim.
• It is a specified and tested protocol with native transport code, not a mesh that has been run across many devices in the field.

Stack