DTN / LTP — selected stack
BPv7 + BPSec / LTP RFC 5326 / Encapsulation Packet Protocol 133.1-B-3 / AOS virtual-channel packet service 732.0-B-4 (2021 documentary baseline, not latest edition); CGR/SABR 734.3-B-1 routing. LTP segment binding follows 734.1-B-1 Annex B. No UDP, IP, TCPCL or TLS. Bidirectional adjacent links, locally supplied contact/range plans, peer/engine mapping, clocks and keys; singleton BP endpoints. All-red block transfer selected; optional green-part service is not credited. Final-pair BCB-AES-GCM and BIB-HMAC-SHA2 protect payload and authenticate a configured remote security source; no relay-held final keys. No link encryption/SDLS, anonymity overlay, application authentication wrapper or independent-participant discovery directory. Executable bindings, BPv7/SABR metadata mapping and allocation rules remain unqualified. CCSDS mission conformance and unrestricted local engine/channel assignment are not asserted. BPv7 source witness: ION 154a4cc7354b26661169f8d8b75a4002cd509a9f for native final-source delivery and origin-side critical-bundle replication. Exact-origin pairwise keys, primary and payload integrity coverage, and application checks of both verification flags are required. This pins these BP-layer mechanisms only; complete TCPCL/TLS or LTP/Encapsulation/AOS integration, critical metadata propagation at later hops, custody mapping and simultaneous on-wire path use remain unqualified. Identity witness for independent deployment: private-use ipn EIDs confined to one administrative domain, with locally generated pairwise BPSec keys and exact-EID receiver policies. EID uniqueness and key distribution are configured by the participants; no public-key self-certification, automatic trust or global uniqueness is claimed. This does not settle AOS SCID allocation in S03. F16 bounded configuration: F16 alternative witness: ION 154a4cc with optional BSL 468db9b enabled and mandatory APPOUT wildcard-source BIB verification over primary and payload. One authorized remote sender at a time; a fresh secret key is held only by that sender and the final receiver, never transit. Native policy uses a locally fixed key-registry identifier. Revocation uses completed shutdown of receiver and consumers, a fresh empty bundle/fragment/delivery store and a fresh key provisioned only to the newly authorized sender. No hot revocation, simultaneous independent-key allowlist, or claimed source-EID authentication is inferred from this witness; F21 retains its separate exact-source policy. This final BP delivery gate is independent of the chosen CGR route and LTP ingress. It does not qualify the complete LTP/Encapsulation/AOS executable binding.
Official project website · Logo credits · Methodology and limits