postern.network
A mutually authenticated, encrypted channel between devices you have explicitly enrolled. Everyone else gets silence.
at the door · live
Scanners find the port. They always do. What they get back is nothing at all — no banner, no error, no version string, not even a refusal to interpret. There is no reply to grep.
An enrolled key gets a different evening entirely: a handshake, fresh session keys, an open channel. Same port, same packet shape. The only difference is whether you were let in beforehand.
↑ press the button. you are not enrolled.
Resistance is a smaller door, not a longer wall.
Most defences add layers. Postern removes them. It shrinks what an attacker can reach before authentication to a single handshake, and what an authenticated peer can do after it to a named list of operations. Fewer parsers to probe, no login flow to walk, no application behaviour to enumerate.
This is an architectural judgement about attack surface — against a tireless automated attacker, the useful defence is to leave almost nothing to explore. It is not a promise that no exploit can ever exist.
two ways to arrive
A source you never allowlisted, or a key you never enrolled. Postern drops it unread. The handshake path is rate-limited per source, so a flood cannot force the machine to do real work on a stranger's behalf.
A key you placed in the registry yourself, out of band. A Noise handshake proves both ends hold their enrolled keys and derives fresh session keys — authenticated, replay-protected and forward-secret — before a single application byte is read.
what the channel guarantees
Built on the Noise IK pattern — the handshake family behind WireGuard. Both ends prove possession of an enrolled key before anything else happens.
Ephemeral keys per session. A static key stolen tomorrow does not decrypt what was said today.
A sliding window rejects captured packets resent later, in any order.
Unrecognised traffic is discarded without a response. Nothing to fingerprint, nothing to answer.
A key is granted named operations and nothing more. Passing the gate is not the run of the house.
Remove a key from the registry and its next packet is refused. Any live session falls in behind it.
on the wire
0000 03 a4 1f 7c 02 00 00 00 00 00 00 11 9e 2c 8f 41 d3 0010 7b e0 55 1a 93 c4 6d 20 af 38 b1 0c e9 72 45 dd 0020 36 8a c7 15 f0 4b 92 61 ae 03 d8 57 2b 9f 64 e1 0030 10 7d a6 33 c2 58 8e 04 b7 2f 6c 91 d5
No DNS, no HTTP, no browsers, no certificate authority. With fixed addresses and provisioned keys, the channel needs none of them. The operating system still routes packets; everything above that is only what the traffic requires.
what it carries
Services, devices, and agents you control, speaking only to each other. In an agentic setting, Postern decides who is speaking; a separate control decides whether the requested action is allowed. The two stay distinct on purpose.
Terminate the channel at the actual receiving application, not a shared gateway. A tunnel that ends at a gateway protects only as far as the gateway — keep the door at the room you are actually guarding.
two shapes
One node binds the port and answers; enrolled devices call it. The right shape when one side is genuinely a service — a vault, a sensor gateway, an agent host.
Every node answers and calls on the same socket. No hub, no directory, no broker — each node decides for itself who it will speak to and what they may ask. The right shape for a team that trusts each other directly.
Eight people is 28 links, and each node holds 7 entries — a roster you can read on one screen. A peer is a device, not a person, so a lost laptop is revoked without touching that person's phone.
Everyone holds the same roster. To confirm it, the team gets on a call and reads one number aloud:
roster v3 BP9B-M5T4-PDDG
Keys, grants and revocations are in that number; addresses are not, so people can roam without re-verifying. If two peers dial each other at the same instant, both sides discard the same session without conferring — they keep the one started by the higher key.
The cost of having no authority: a revocation takes effect on each node when that node updates. A colleague holding yesterday's roster still trusts yesterday's key. Postern makes that disagreement visible — peers can ask each other for their fingerprint — rather than pretending it away.
next · keri
The mesh has one real weakness: trust arrives by courier. Someone sends the roster, and everyone believes it. KERI replaces the courier with evidence.
Each person holds an autonomic identifier — an AID — whose key history is an append-only, witnessed key event log. The device keys Postern handshakes with are anchored to that log. Enrolling a laptop is an event; revoking it is an event. Any node can verify either from the log itself, without trusting whoever forwarded it.
Pre-rotation makes loss survivable. Every event commits to the digest of the next key before that key is ever used, so a stolen current key cannot rotate the identity away from its owner.
sn 0 icp inception signing k0 · commits next H(k1) · witnesses 2 of 3 sn 1 ixn anchor device x25519 e7:1c:9a:04… ana-laptop · ping,status sn 2 ixn anchor device x25519 3f:a0:12:8b… ana-phone · ping sn 3 ixn revoke device x25519 e7:1c:9a:04… laptop reported lost sn 4 rot rotation k1 becomes current · commits next H(k2)
Verification happens away from the door. Nodes fetch and check logs in the background, never in the handshake path, so what a stranger can reach before authentication stays exactly as small as it is now.
what a small door does not do
A compromised enrolled device crosses the boundary like any legitimate one. Protect keys at rest, revoke quickly, keep each peer's authority small.
Encryption cannot stop someone flooding the pipe itself. That needs upstream protection and, where it matters, independent connectivity.
An authenticated packet can still ask for something harmful. Whether to act on it is a decision that lives above the channel, not inside it.
getting in
Postern has no public registration by design — and neither does this page. Enrolment happens out of band, through a channel you already trust. Two parties exchange public keys directly and add each other to the registry. That exchange is the whole ceremony.
A strong minimal design — not a proven “most resistant” protocol. Resistance depends on how much code an attacker can reach, how keys are protected, and what an authenticated peer is allowed to do. The judgement here is architectural, and it is stated rather than sold.