Back to column

RINA — selected stack

RINA application flows over recursively composed normal DIFs, with an Ethernet shim at the bottom; participant-operated enrollment and management, locally configured application names and DIF membership. Select QoS-aware flow allocation and per-DIF congestion-control policies acting on aggregate lower-layer flows. IRATI/Linux is the implementation reference for subsequent qualification, not a claim that a pinned executable configuration has been validated. No IP shim, external naming authority or application security wrapper is supplied; selected native modes are stated explicitly below. Current positive entries establish documented architectural mechanisms; implementation coverage, security and operational adoption require separate evidence. Mobility witness: additionally select the native Wi-Fi shim and local mobman two-provider make-before-break policy documented in IRATI Tutorial 10, with two interfaces and preconfigured DIF membership. This is a bounded mobility mode, not an IP overlay or a validated combined deployment; no security suite is imported from the demonstrator. Redundant-path mode: additionally select native static routing with two entries for the same destination/QoS and distinct next hops, default PDUFT generation and default PFF/RMT, over provisioned loop-free paths converging on one receiving IPCP. Source inspection establishes proactive copying; this is an explicit optional mode, not the default Dijkstra or the per-flow multipath plugin. Use a DTCP-enabled flow when duplicate handling is required; complete duplicate/reordering behavior and the combined deployment remain untested. Authentication mode: select native PSOC_authentication-ssh2 version 1 for IPCP enrollment, locally generated RSA keys of at least 2048 bits and locally provisioned peer-name/public-key bindings, with EDH, AES256, SHA256 and deflate under default SDU protection. The pinned code implements finite-field ephemeral DH, despite the README elliptic-curve wording. This custom SSH2-inspired mechanism is not asserted to be SSH interoperability or an audited modern security construction. Authentication scope is the enrolled IPCP; final application identity exposure remains a separate qualification; end-host content protection requires the upper-DIF placement specified below. No post-quantum KEM is selected. End-host confidentiality mode: place an additional normal DIF with only the two endpoint-host IPCPs above the routed transit DIFs; select the declared SSH2-inspired authentication and AES256 SDU protection between these two members. Applications register to this upper DIF. Transit nodes participate only in lower DIFs and do not hold the upper-DIF keys. This native recursive composition is an architectural/source-supported option, not a validated combined deployment. The endpoint OS/IPCP is trusted; protection between mutually untrusted applications sharing that OS is not claimed. For passive established-traffic assessment, enable the selected SDU encryption on every normal-DIF adjacency, including the lowest normal DIF above Ethernet/Wi-Fi; no plaintext normal-DIF adjacency exception is selected. Link framing and bootstrap remain outside the encrypted normal-DIF PDU.

Official project website · Logo credits · Methodology and limits