Struct SecurityConfig 

pub struct SecurityConfig {
    pub require_transport_identity: bool,
}

Security configuration for transport and control-message hardening.

Fields

require_transport_identity: bool

When true, control messages with no transport-level peer identity (transport_peer_id is None) are rejected. When false (default), missing transport identity emits a SecurityWarning but allows the message through (best-effort / fail-open).

Why the default (false) is not the weak setting it once was

This flag used to carry real weight, because a forged sender was otherwise cheap: identities were app-chosen strings and the only thing standing behind one was a trust-on-first-use pin, so first contact with any peer was open to a man-in-the-middle and transport identity was the only independent corroboration available.

Under self-certifying addressing it is not. Every security-gated control frame must now carry an Ed25519 signature — unconditionally, no longer gated on this flag — and the signing key must derive to the address in sender. A forged sender therefore requires the private key behind that address, on first contact as much as on the thousandth. Transport identity adds no authenticity on top of that; it only cross-checks a claim the signature already proved.

The strict match on frames claiming direct origin (hop_count == 0) runs regardless of this flag, as it always has, and is unaffected.

What enabling it still does, and what it costs

Exactly one thing: control frames arriving with no transport identity at all are rejected instead of falling through to the signature gate.

That is a real cost with no matching benefit on most deployments. Nostr frames carry no transport identity by construction — the Nostr pubkey is an install signing key, not the protocol id, so attaching it would fail the strict match (see nostr_message_received_inner) — and relay frames that arrive without a named sender are in the same position. Turning this on rejects every control message on those paths, including the key-package exchange that cold contact depends on. Mesh-forwarded frames re-created by intermediate nodes legitimately lack identity too.

Set to true only on a deployment that runs neither Nostr nor sender-less relay delivery, and wants frames without transport identity refused as a matter of policy rather than of authentication.

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> SecurityConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> SecurityConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecurityConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecurityConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.