F26-GN: Yes
Rationale
GNUnet 0.20.0 CORE accepts encrypted payload only in an established key-exchange state, verifies its HMAC and applies sequence/replay and age checks before delivering messages to clients. CADET registers its transit handlers through GNUNET_CORE_connect. Invalid session traffic is therefore rejected at the adjacent CORE boundary before it can trigger CADET onward forwarding.
Assessment method
Primary normative source and selected adjacency-policy analysis; no execution
Source context
GNUnet 0.20.0 core_kx handle_encrypted/deliver_message and CADET CORE registration
Outstanding qualification
Credit hop-by-hop session admission and authenticated message delivery in the selected legacy TRANSPORT/CORE/CADET composition. This is not an administrator allowlist of final sources: a peer that establishes a valid session may still send abusive traffic. UDP ingress bandwidth, key-exchange work and authentication CPU remain exposed. The evidence is source ordering, not a runtime integration, flood or throughput test; final CADET application admission is a separate criterion.
Public sources
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round458.html
- round458-sources.json