Self-configuring, encrypted and resilient mesh networking stack for LoRa, packet radio, WiFi and everything in between
Reticulum is the cryptography-based networking stack for building local and wide-area networks with readily available hardware. It can operate even with very high latency and extremely low bandwidth. Reticulum allows you to build wide-area networks with off-the-shelf tools, and offers end-to-end encryption and connectivity, initiator anonymity, autoconfiguring cryptographically backed multi-hop transport, efficient addressing, unforgeable delivery acknowledgements and more.
The vision of Reticulum is to allow anyone to be their own network operator, and to make it cheap and easy to cover vast areas with a myriad of independent, inter-connectable and autonomous networks. Reticulum is not one network. It is a tool for building thousands of networks. Networks without kill-switches, surveillance, censorship and control. Networks that can freely interoperate, associate and disassociate with each other, and require no central oversight. Networks for human beings. Networks for the people.
Reticulum is a complete networking stack, and does not rely on IP or higher layers, but it is possible to use IP as the underlying carrier for Reticulum. It is therefore trivial to tunnel Reticulum over the Internet or private IP networks.
Having no dependencies on traditional networking stacks frees up overhead that has been used to implement a networking stack built directly on cryptographic principles, allowing resilience and stable functionality, even in open and trustless networks.
No kernel modules or drivers are required. Reticulum runs completely in userland, and can run on practically any system that runs Python 3.
The full documentation for Reticulum is available at markqvist.github.io/Reticulum/manual/.
You can also download the Reticulum manual as a PDF or as an e-book in EPUB format.
For more info, see reticulum.network and the FAQ section of the wiki.
While Reticulum is already a fully featured and functional networking stack, many improvements and additions are actively being worked on, and planned for the future.
To learn more about the direction and future of Reticulum, please see the Development Roadmap.
If you want to quickly get an idea of what Reticulum can do, take a look at the following resources.
Over practically any medium that can support at least a half-duplex channel with greater throughput than 5 bits per second, and an MTU of 500 bytes. Data radios, modems, LoRa radios, serial lines, AX.25 TNCs, amateur radio digital modes, WiFi and Ethernet devices, free-space optical links, and similar systems are all examples of the types of physical devices Reticulum can use.
An open-source LoRa-based interface called RNode has been designed specifically for use with Reticulum. It is possible to build yourself, or it can be purchased as a complete transceiver that just needs a USB connection to the host.
Reticulum can also be encapsulated over existing IP networks, so there's nothing stopping you from using it over wired Ethernet, your local WiFi network or the Internet, where it'll work just as well. In fact, one of the strengths of Reticulum is how easily it allows you to connect different mediums into a self-configuring, resilient and encrypted mesh, using any available mixture of available infrastructure.
As an example, it's possible to set up a Raspberry Pi connected to both a LoRa radio, a packet radio TNC and a WiFi network. Once the interfaces are configured, Reticulum will take care of the rest, and any device on the WiFi network can communicate with nodes on the LoRa and packet radio sides of the network, and vice versa.
The best way to get started with the Reticulum Network Stack depends on what you want to do. For full details and examples, have a look at the Getting Started Fast section of the Reticulum Manual.
To simply install Reticulum and related utilities on your system, the easiest way is via pip.
You can then start any program that uses Reticulum, or start Reticulum as a system service with
the rnsd utility.
pip install rns
If you are using an operating system that blocks normal user package installation via pip,
you can return pip to normal behaviour by editing the ~/.config/pip/pip.conf file,
and adding the following directive in the [global] section:
[global]
break-system-packages = true
Alternatively, you can use the pipx tool to install Reticulum in an isolated environment:
pipx install rns
When first started, Reticulum will create a default configuration file, providing basic connectivity to other Reticulum peers that might be locally reachable. The default config file contains a few examples, and references for creating a more complex configuration.
If you have an old version of pip on your system, you may need to upgrade it first with pip install pip --upgrade. If you no not already have pip installed, you can install it using the package manager of your system with sudo apt install python3-pip or similar.
For more detailed examples on how to expand communication over many mediums such as packet radio or LoRa, serial ports, or over fast IP links and the Internet using the UDP and TCP interfaces, take a look at the Supported Interfaces section of the Reticulum Manual.
Reticulum includes a range of useful utilities for managing your networks, viewing status and information, and other tasks. You can read more about these programs in the Included Utility Programs section of the Reticulum Manual.
rnsd for running Reticulum as an always-available servicernstatus, that displays information about interfacesrnpath letting you view and modify path tablesrnprobe for checking connectivity to destinationsrncp making it easy to transfer files between systemsrnid let's you manage Identities and encrypt/decrypt filesrnx let's you run commands and
programs and retrieve output from remote systemsAll tools, including rnx and rncp, work reliably and well even over very
low-bandwidth links like LoRa or Packet Radio. For full-featured remote shells
over Reticulum, also have a look at the rnsh
program.
Reticulum implements a range of generalised interface types that covers most of the communications hardware that Reticulum can run over. If your hardware is not supported, it's relatively simple to implement an interface class. I will gratefully accept pull requests for custom interfaces if they are generally useful.
Currently, the following interfaces are supported:
Reticulum targets a very wide usable performance envelope, but prioritises functionality and performance on low-bandwidth mediums. The goal is to provide a dynamic performance envelope from 250 bits per second, to 1 gigabit per second on normal hardware.
Currently, the usable performance envelope is approximately 150 bits per second to 40 megabits per second, with physical mediums faster than that not being saturated. Performance beyond the current level is intended for future upgrades, but not highly prioritised at this point in time.
Reticulum should currently be considered beta software. All core protocol features are implemented and functioning, but additions will probably occur as real-world use is explored. There will be bugs. The API and wire-format can be considered relatively stable at the moment, but could change if warranted.
The installation of the default rns package requires the dependencies listed
below. Almost all systems and distributions have readily available packages for
these dependencies, and when the rns package is installed with pip, they
will be downloaded and installed as well.
On more unusual systems, and in some rare cases, it might not be possible to
install or even compile one or more of the above modules. In such situations,
you can use the rnspure package instead, which require no external
dependencies for installation. Please note that the contents of the rns and
rnspure packages are identical. The only difference is that the rnspure
package lists no dependencies required for installation.
No matter how Reticulum is installed and started, it will load external
dependencies only if they are needed and available. If for example you want
to use Reticulum on a system that cannot support
pyserial, it is perfectly possible to
do so using the rnspure package, but Reticulum will not be able to use
serial-based interfaces. All other available modules will still be loaded when
needed.
Please Note! If you use the rnspure package to run Reticulum on systems
that do not support PyCA/cryptography,
it is important that you read and understand the Cryptographic
Primitives section of this document.
If you just want to get started experimenting without building any physical networks, you are welcome to join the RNS Development Testnet.
The testnet is just that, an informal network for testing and experimenting. It will be up most of the time, and anyone can join, but it also means that there's no guarantees for service availability.
It probably goes without saying, but don't use the testnet entry-points as hardcoded or default interfaces in any applications you ship to users. When shipping applications, the best practice is to provide your own default connectivity solutions, if needed and applicable, or in most cases, simply leave it up to the user which networks to connect to, and how.
The testnet runs the very latest version of Reticulum (often even a short while before it is publicly released). Sometimes experimental versions of Reticulum might be deployed to nodes on the testnet, which means strange behaviour might occur. If none of that scares you, you can join the testnet via either TCP or I2P. Just add one of the following interfaces to your Reticulum configuration file:
# TCP/IP interface to the RNS Amsterdam Hub
[[RNS Testnet Amsterdam]]
type = TCPClientInterface
enabled = yes
target_host = amsterdam.connect.reticulum.network
target_port = 4965
# TCP/IP interface to the BetweenTheBorders Hub (community-provided)
[[RNS Testnet BetweenTheBorders]]
type = TCPClientInterface
enabled = yes
target_host = reticulum.betweentheborders.com
target_port = 4242
# Interface to Testnet I2P Hub
[[RNS Testnet I2P Hub]]
type = I2PInterface
enabled = yes
peers = g3br23bvx3lq5uddcsjii74xgmn6y5q325ovrkq2zw2wbzbqgbuq.b32.i2p
The testnet also contains a number of Nomad Network nodes, and LXMF propagation nodes.
You can help support the continued development of open, free and private communications systems by donating via one of the following channels:
84FpY1QbxHcgdseePYNmhTHcrgMX4nFfBYtz2GKYToqHVVhJp8Eaw1Z1EedRnKD19b3B8NiLCGVxzKV17UMmmeEsCrPyA5w
0xFDabC71AC4c0C78C95aDDDe3B4FA19d6273c5E73
35G9uWVzrpJJibzUwpNUQGQNFzLirhrYAH
Are certain features in the development roadmap are important to you or your organisation? Make them a reality quickly by sponsoring their implementation.
Reticulum uses a simple suite of efficient, strong and well-tested cryptographic primitives, with widely available implementations that can be used both on general-purpose CPUs and on microcontrollers. The utilised primitives are:
In the default installation configuration, the X25519, Ed25519 and
AES-128-CBC primitives are provided by OpenSSL
(via the PyCA/cryptography package).
The hashing functions SHA-256 and SHA-512 are provided by the standard
Python hashlib. The HKDF,
HMAC, Fernet primitives, and the PKCS7 padding function are always
provided by the following internal implementations:
Reticulum also includes a complete implementation of all necessary primitives in pure Python. If OpenSSL & PyCA are not available on the system when Reticulum is started, Reticulum will instead use the internal pure-python primitives. A trivial consequence of this is performance, with the OpenSSL backend being much faster. The most important consequence however, is the potential loss of security by using primitives that has not seen the same amount of scrutiny, testing and review as those from OpenSSL.
If you want to use the internal pure-python primitives, it is highly advisable that you have a good understanding of the risks that this pose, and make an informed decision on whether those risks are acceptable to you.
Reticulum is relatively young software, and should be considered as such. While it has been built with cryptography best-practices very foremost in mind, it has not been externally security audited, and there could very well be privacy or security breaking bugs. If you want to help out, or help sponsor an audit, please do get in touch.
Reticulum can only exist because of the mountain of Open Source work it was built on top of, the contributions of everyone involved, and everyone that has supported the project through the years. To everyone who has helped, thank you so much.
A number of other modules and projects are either part of, or used by Reticulum. Sincere thanks to the authors and contributors of the following projects:
FAQs
Self-configuring, encrypted and resilient mesh networking stack for LoRa, packet radio, WiFi and everything in between
We found that rns demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.