The ANet project (ANet Secure Transport Protocol) develops an alternative stack for creating secure tunnels, designed to connect private networks in situations where standard solutions (WireGuard, OpenVPN) cannot be applied for various reasons. The project is positioned not as yet another fork of WireGuard, but as a 'Friends-to-Friends' VPN, focusing on the use of proven cryptographic algorithms and autonomous operation in a 'Dead Man’s Hand' mode. ANet employs its own transport protocol, ASTP (ANet Secure Transport Protocol), which ensures complete end-to-end encryption, resistant to high packet loss and indistinguishable from random UDP traffic. The code is written from scratch in Rust and is distributed under the MIT license, with an explicit prohibition against including dependencies under GPL 2.0 and 3.0.
Main features:
- Utilization of cryptographic algorithms ChaCha20/Poly1305 for the stream, X25519 for Ephemeral DH, Ed25519 for authentication. No legacy algorithms or 'workarounds for compatibility with Windows XP'.
- Transport based on a QUIC-like wrapper over UDP, but with its own framing: each packet is wrapped in an encrypted 'envelope' with random additional padding and jitter (from 0 to N nanoseconds), which masks the connection negotiation process as white noise.
- Distributed architecture with an authorization server (anet-auth) that checks the client fingerprint (SHA256 of the public key based on Ed25519). The tunnel is initiated based on a PSK (pre-shared key) obtained through a 4-phase handshake (DH + double ratchet). If the auth server goes down, the network continues to operate on pre-loaded keys (failover to full local mode).
- Supported platforms: Linux (TUN), Windows (Wintun), macOS (utun), Android (VpnService via JNI). There is a GUI on egui (Rust-native), and a TUI for headless servers. Binary builds are provided.
Unlike WireGuard with its recognizable handshake (Magic number + Noise Protocol) and OpenVPN characteristic TLS fingerprint, in the ASTP protocol, each packet starts with a random nonce (12 bytes), followed by variable-length ciphertext with additional padding to the nearest block size (configurable). For an external observer, the traffic is indistinguishable from random. ANet is presented as an attempt to bring back the VPN ‘physicality’ of the floppy net era (HDD at a friend's), but in digital form: PSK (pre-shared keys), manual route management, 'zero-knowledge proof' via fingerprint.
The project is accompanied by a Code of Conduct, prepared in accordance with the principle of 'radical honesty'. The rules state the 'right to send away' (the right to dismiss any developer for poor code), 'mirror response' (complaints about toxicity are ignored), priority of code (it doesn't matter who the author is, but rather the quality of the code), and a ban for attempts to enforce political correctness.
Source: opennet.ru
