# Betanet Version 1.0 – Official Implementation Specification
1
+
# Betanet Version 1.1 – Official Implementation Specification
2
2
3
-
> **Normative document.**All requirements marked **MUST**, **MUST NOT**, or **SHALL** are mandatory for compliance.
3
+
> **Normative document.** All requirements marked **MUST**, **MUST NOT**, or **SHALL** are mandatory for compliance.
4
4
5
5
---
6
6
7
7
## 0 Status & Scope
8
8
9
9
Betanet is a fully decentralised, censorship-resistant network intended to replace the public Internet.
10
-
The design eliminates single points of failure, disguises itself as ordinary HTTPS, and makes selective blocking economically or politically prohibitive.
10
+
This revision finalises covert transport indistinguishability, removes linkability vectors, specifies liveness for naming, hardens governance and bootstrap economics, and standardises adaptive calibration.
> † Offering the hybrid ciphersuite **MUST** be after *2027-01-01*.
34
+
**PQ requirement.** From *2027-01-01*, the **inner** key agreement (L2 §5.3) **MUST** be hybrid X25519-Kyber768. The **outer** TLS handshake (L2 §5.1) **MUST** mirror the front origin and **MUST NOT** advertise PQ that diverges from the origin’s canonical fingerprint.
35
+
36
+
**Algorithm agility.** Implementations **MUST** expose a registry of cryptographic parameters keyed by OIDs; future substitutions **MUST** be negotiated via governance (L7) without changing wire formats where lengths permit.
* Gateways **MUST** verify `TS` within **±300 s**, reject duplicate `(FLOW,TS)` for **2 h**, and apply per-peer token buckets.
91
+
* SCION payloads are carried on subsequent HTX streams. No per-packet transition header appears on the public wire.
92
+
* Gateways **MUST** close and re-establish the control stream on rekey (§5.3). Out-of-date control streams are invalid.
83
93
84
-
Gateways **MUST**verify and strip this header when re-entering a SCION-capable segment.
94
+
**Public-Internet requirement.**The legacy on-wire transition header is **PROHIBITED** on public networks. It **MAY** be used only on private, administratively controlled links (§11).
85
95
86
96
### 4.3 Path Maintenance
87
97
88
-
End hosts **MUST** maintain **≥ 3** disjoint validated paths to every peer and switch within **300 ms** of failure detection.
98
+
* Maintain **up to 3** disjoint validated paths per peer.
99
+
* Switch within **300 ms** when an alternative validated path exists.
100
+
* Probe with exponential back-off (min 1 s, max 60 s); **MUST NOT** exceed 1 probe per destination per **10 s** under persistent loss.
* Hybrid ciphersuite (Kyber768) **MUST** be present once the date criterion is met.
108
+
* Clients **MUST** mirror the front origin’s fingerprint class (JA3/JA4 family, ALPN set, extension order, GREASE, H2 SETTINGS, H3 availability).
109
+
* A **per-connection calibration pre-flight** to the same origin (or same CDN POP if indicated) **MUST** be performed before inner handshake; any deviation **MUST** fail closed.
110
+
***Tolerances:** ALPN **set and order MUST match exactly**. Extension order **MUST match exactly**. H2 SETTINGS values **MUST** be within **±15 %** of calibrated origin values where the origin publishes variable ranges; otherwise **MUST** match exactly.
111
+
***POP selection:** If the origin presents geo/POP variance, clients **MUST** calibrate against the same POP as the target connection as indicated by authoritative DNS co-location or CDN route headers; otherwise calibration **MUST** be repeated until equality is achieved.
112
+
* ALPN selection **MUST** match the origin; fixed global distributions are **PROHIBITED**.
113
+
* Session resumption **MUST** follow origin policy; **0-RTT MUST NOT** be used for HTX initiation.
***Body (POST)** with `Content-Type: application/x-www-form-urlencoded` containing `bn1=<Base64URL(payload)>`.
134
+
8. Server verification:
135
+
136
+
* recompute for `hour ∈ {now-1, now, now+1}`,
137
+
* reject duplicates for tuple `(cliPub, hour)` within **2 h**,
138
+
* enforce per-/24 IPv4 and /56 IPv6 token buckets.
139
+
9. Servers **MUST** parse fields in order (`version, cliPub32, ticketKeyID8, nonce32, accessTicket32`) and **MUST ignore trailing bytes** (padding). Accepted padding range is **24..64 bytes**.
140
+
10. On duplicate rejection, clients **SHOULD** rotate `cliPub`.
* Ordering: Receivers **MUST** accept `KEY_UPDATE` out-of-order relative to data frames and **MUST** discard frames that verify only under the previous key after receiving and acknowledging `KEY_UPDATE`. Senders **MUST** cease using the old key immediately after transmitting `KEY_UPDATE`.
* H2 SETTINGS **MUST** mirror origin within tolerances learned during pre-flight (§5.1).
175
+
* PING cadence **MUST** be random in **\[10 s, 60 s]** with ±10 % jitter; periodicity is **PROHIBITED**.
176
+
* PRIORITY frames **SHOULD** follow the origin’s baseline rate; if unknown, send on **\[0.5 %, 3 %]** of connections at random.
177
+
* Idle padding: if no DATA for **\[200 ms, 1 200 ms]**, send **\[0, 3 KiB]** dummy encrypted DATA (uniform in both).
143
178
144
-
Idle padding: if no DATA for 512 ± 128 ms, send dummy 1 KiB encrypted DATA.
179
+
### 5.6 UDP Variant & Anti-Correlation Fallback
145
180
146
-
### 5.6 UDP Variant
147
-
148
-
*Attempt QUIC v1 on UDP-443 + MASQUE `CONNECT-UDP`.
149
-
*On failure, retry TCP within **500 ms**.
181
+
* Attempt QUIC v1 on UDP-443 with MASQUE `CONNECT-UDP`.
182
+
* On failure, retry TCP with randomized back-off **\[200 ms, 1 200 ms]**, **fresh** ClientHello randomness, no session resumption, and fresh QUIC CIDs when applicable.
183
+
*To defeat induced linkability, clients **MUST** launch **cover connections** to **≥ 2** unrelated origins (non-HTX) within **\[0, 1 000 ms]** of the retry; HTX start **MUST** be delayed by an additional **\[100, 700 ms]** chosen independently.
184
+
*Cover connections **MUST NOT** exceed **2** retries per minute and **MUST** be torn down within **\[3, 15] s** unless they carry user traffic.
150
185
151
186
---
152
187
@@ -159,45 +194,70 @@ Idle padding: if no DATA for 512 ± 128 ms, send dummy 1 KiB encrypted DATA.
*`BeaconSet(epoch) = XOR32(drand(epoch), nistRBv2(epoch), ethL1_finalized_hash(epoch))`, each a 32-byte value; components **MAY** be substituted by governance.
245
+
* If **all** components are unavailable, use fallback
246
+
`BeaconSet(epoch) = SHA256("bn-fallback" ‖ K0c ‖ uint64_be(epoch))` and **MUST** log the condition.
247
+
* For each stream, initiator picks 16-B `streamNonce`.
Each `sig` is Ed25519 over `("bn-aa1" ‖ payloadHash ‖ epoch)`. Verifiers **MUST** validate weights per §10.2–§10.3 and reject duplicates or lower-epoch certificates.
304
+
230
305
---
231
306
232
307
## 9 Payment System (L6)
233
308
234
309
### 9.1 Federated Cashu Mints
235
310
236
311
* Each mint = FROST-Ed25519 **(n ≥ 5, t = 3)** group.
237
-
* Keyset ID =`SHA-256(sorted pubkeys)`.
238
-
* Relays **MUST** accept vouchers from any announced keyset (topic `betanet.mints`).
312
+
* Keyset ID = `SHA-256(sorted pubkeys)`.
313
+
* Mints announce on `betanet.mints` with **≥ 22-bit** PoW and an HTX contact endpoint.
314
+
315
+
**Voucher (128 B):**
316
+
317
+
```
318
+
keysetID32 ‖ secret32 ‖ aggregatedSig64
319
+
```
239
320
240
-
Voucher (64 B): `secret32 || aggregatedSig32`.
321
+
*`aggregatedSig64` is the 64-B Ed25519 aggregate signature over `secret32`.
322
+
* Relays **MUST** accept vouchers only for known keysets; unknown keysets **MAY** be cached pending validation.
323
+
* Per-keyset and per-peer rate-limits **MUST** apply.
241
324
242
325
### 9.2 Settlement
243
326
244
327
Relays **MAY** redeem ≥ 10 000 sat via their own Lightning node or swap with peers.
245
-
Vouchers never leave encrypted streams.
328
+
Vouchers **MUST NOT** leave encrypted streams.
246
329
247
330
---
248
331
@@ -251,43 +334,61 @@ Vouchers never leave encrypted streams.
1.`Σ weight(ACK) ≥ 0.67 × Σ weight(active_nodes_14d)`, where `active_nodes_14d` are nodes seen on HTX within **14 days**.
355
+
2. ACKs span **≥ 24** distinct AS groups and **≥ 3** SCION ISDs; no single AS contributes **> 20 %** nor single Org **> 25 %** of ACK weight.
356
+
3. ACKs are observed over **≥ 2** disjoint path classes per §4 with consistent reachability (median loss < 2 %).
357
+
4. A **partition check** confirms the median path diversity and ACK composition did not degrade by > 20 % in the **7 days** prior to close.
268
358
269
-
### 10.3 Upgrade Delay
359
+
### 10.4 Upgrade Delay
270
360
271
-
After threshold reached, activation waits **≥ 30 days**.
272
-
Raven Development Team publishes a time-lock hash of the final spec text.
361
+
After threshold, activation waits **≥ 30 days**. If §10.3 fails at any time ≥ 7 days before activation, activation **MUST** be deferred until criteria are met for **7** consecutive days.
362
+
Raven Development Team publishes a time-lock hash of the final text.
273
363
274
364
---
275
365
276
366
## 11 Compliance Summary
277
367
278
368
An implementation is **compliant** if it:
279
369
280
-
1. Implements HTX over TCP-443 **and** QUIC-443 with TLS 1.3 mimic + ECH.
281
-
2. Uses rotating access tickets (§5.2).
282
-
3. Encrypts inner frames with ChaCha20-Poly1305, 24-bit length, 96-bit nonce.
283
-
4. Maintains ≥ 3 signed SCION paths **or** attaches a valid IP-transition header.
9. Builds reproducibly and publishes **SLSA 3** provenance.
289
-
10. Presents X25519-Kyber768 suites once the mandatory date is reached.
370
+
1. Implements HTX over TCP-443 **and** QUIC-443 with origin-mirrored TLS + ECH; performs per-connection calibration (§5.1).
371
+
2. Uses **negotiated-carrier, replay-bound** access tickets (§5.2) with variable lengths and rate-limits.
372
+
3. Performs inner Noise *XK* with key separation, nonce lifecycle, and rekeying (§5.3); uses hybrid X25519-Kyber768 from *2027-01-01*.
373
+
4. Emulates HTTP/2/3 with adaptive cadences and origin-mirrored parameters (§5.5).
374
+
5. Bridges non-SCION links by **HTX-tunnelled transition**; no on-wire transition header on public networks (§4.2).
375
+
6. Offers `/betanet/htx/1.1.0` and `/betanet/htxquic/1.1.0` transports (§6.2).
376
+
7. Bootstraps via rotating rendezvous IDs derived from **BeaconSet** with PoW and multi-bucket rate-limits; deterministic seeds not used (§6.3–§6.5).
377
+
8. Selects mixnodes using BeaconSet randomness with per-stream entropy and path diversity (§7.2); “balanced” mode enforces **≥ 2** hops until trust ≥ **0.8** (§7.1–§7.3).
378
+
9. Verifies alias ledger with **finality-bound 2-of-3** and applies **Emergency Advance** liveness only under §8.2 conditions; validates quorum certificates as specified.
379
+
10. Accepts 128-B Cashu vouchers for known keysets with PoW adverts and rate-limits; supports Lightning settlement (§9).
380
+
11. Enforces anti-concentration caps, diversity, and partition checks for governance (§10).
381
+
12. Implements anti-correlation fallback with cover connections on UDP→TCP retries (§5.6).
382
+
13. Builds are reproducible and publish **SLSA 3** provenance artifacts for release binaries.
383
+
384
+
---
385
+
386
+
## 12 Interoperability Notes (1.0 Compatibility)
387
+
388
+
* 1.1 peers **MAY** offer `/betanet/htx/1.0.0` ALPN for legacy interop.
389
+
* Legacy on-wire transition headers **MUST NOT** be used on public networks; bridge via HTX tunnels.
390
+
* 64-B vouchers **MAY** be issued only to legacy peers; 1.1 receivers **MUST** accept both for the operator-defined deprecation window.
0 commit comments