Struct SecurityConfig 

pub struct SecurityConfig {
    pub require_transport_identity: bool,
    pub control_freshness_enforced: bool,
}

Security configuration for transport and control-message hardening.

Fields

require_transport_identity: bool

When true, control messages with no transport-level peer identity (transport_peer_id is None) are rejected. When false (default), missing transport identity emits a SecurityWarning but allows the message through (best-effort / fail-open).

Why the default (false) is not the weak setting it once was

This flag used to carry real weight, because a forged sender was otherwise cheap: identities were app-chosen strings and the only thing standing behind one was a trust-on-first-use pin, so first contact with any peer was open to a man-in-the-middle and transport identity was the only independent corroboration available.

Under self-certifying addressing it is not. Every security-gated control frame must now carry an Ed25519 signature — unconditionally, no longer gated on this flag — and the signing key must derive to the address in sender. A forged sender therefore requires the private key behind that address, on first contact as much as on the thousandth. Transport identity adds no authenticity on top of that; it only cross-checks a claim the signature already proved.

The strict match on frames claiming direct origin (hop_count == 0) runs regardless of this flag, as it always has, and is unaffected.

What enabling it still does, and what it costs

Exactly one thing: control frames arriving with no transport identity at all are rejected instead of falling through to the signature gate.

That is a real cost with no matching benefit on most deployments. Nostr frames carry no transport identity by construction — the Nostr pubkey is an install signing key, not the protocol id, so attaching it would fail the strict match (see nostr_message_received_inner) — and relay frames that arrive without a named sender are in the same position. Turning this on rejects every control message on those paths, including the key-package exchange that cold contact depends on. Mesh-forwarded frames re-created by intermediate nodes legitimately lack identity too.

Set to true only on a deployment that runs neither Nostr nor sender-less relay delivery, and wants frames without transport identity refused as a matter of policy rather than of authentication.

control_freshness_enforced: bool

Whether a control frame is refused for being stale, and whether a peer that has proved it signs the freshness-bound payload is held to it.

Defaults to true. With it on, a control frame signed under offline-ctrl-v2 is checked against CTRL_FRESHNESS_PAST_MS and its future counterpart, a peer that once verifiably signed v2 may not fall back to v1, and a session_reset is honoured only on a frame whose freshness was actually checked. With it off, this node behaves exactly as it did before any of that existed: signatures are still verified, and no frame is refused for its age.

What it is for

The timestamp is read against this device’s clock, so the failure this switch exists for is a clock, not a peer. A device that comes up with an unset clock reads every honest peer’s frame as being from decades in the future and refuses all of them, which takes out the whole control plane — key package exchange included — for as long as the clock is wrong. That is a self-inflicted outage a shipped app cannot wait for a new binary to fix, which is why the lever exists and why it reaches the bindings rather than staying internal.

What turning it off costs

A captured control frame verifies forever again, and a recorded session_reset is once more a repeatable way to tear down a live session (issue 403). It is a diagnosis and recovery tool, not a configuration a deployment should settle on.

Trait Implementations

impl Clone for SecurityConfig

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecurityConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for SecurityConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for SecurityConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for SecurityConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.