build-trust/ockam

Features

• Verifiable Credential Management - Implements a full system for issuing, storing, and verifying signed attribute-based credentials to enable scalable zero-trust networking.
• Zero Trust Networking - Implements a zero-trust networking framework using identity-based access for all communication.
• Asynchronous Message Passings - Creates lightweight, stateful actors that process messages asynchronously and maintain internal state within a node.
• Application-Level - Creates granular, end-to-end secure connections between specific applications across different networks to minimize attack surfaces.
• Legacy Protocol Encapsulation - Wraps raw TCP or Kafka traffic into encrypted routing messages to make security transparent to the original client and server.
• Legacy Application Tunneling - Wraps standard TCP traffic into routed messages using inlets and outlets to enable secure communication without changing application code.
• Encrypted Network Relays - Creates encrypted relays between remote environments using outgoing connections to allow communication without modifying network layers.
• Firewall Bypass Networking - Bypasses network firewalls by establishing outgoing TCP connections to relay services for internal service access.
• Message Routing - Exchanges messages bidirectionally across diverse communication topologies using ordered lists of addresses to define the path.
• Private Network Connectivity - Establishes end-to-end communication with services in remote private networks without requiring the service to expose listening ports.
• Private Relay Hosting - Establishes end-to-end communication with services in private networks by using an outbound connection to a relay node.
• Secure Communication Channels - Provides encrypted tunnels that protect data streams between network endpoints, supporting multi-hop routes across TCP and UDP.
• TCP Tunneling - Wraps legacy TCP traffic into secure, encrypted channels to enable communication without modifying application code.
• Identity-Based Traffic Policies - Enforces message traffic restrictions using boolean expressions based on identity attributes and resource requirements.
• Multi-Hop Routing - Sends data through multiple transport layer connections by manipulating onward and return route metadata at every hop.
• Binary Route Metadata - Routes messages across distributed nodes using compact binary metadata to define network paths.
• Attribute-Based Access Control - Enforces resource access permissions based on signed attributes and metadata found within verifiable credentials.
• Attribute-Based Issuance - Operates credential authorities to provide lightweight, short-lived, and revocable credentials based on user or device attributes.
• Identity Continuity Tracking - Updates public keys periodically and maintains a signed history of rotation events to verify current credentials.
• Identity Key Management - Manages the generation and lifecycle of secret signing keys within secure boundaries like KMS or HSM.
• Decentralized Identity Credentials - Generates signed attestations about subject identity attributes, including expiration timestamps and schema-based attribute maps.
• Verifiable Credential Issuance - Creates signed attestations between identities that include specific attributes to prove subject properties.
• Cryptographic Identity Generation - Generates unique cryptographic identities for devices and services to ensure every entity in the system is identifiable.
• Cryptographic Key Rotations - Provides cryptographic key rotations with a signed history to maintain identity continuity over time.
• End-To-End Encryption Systems - Ensures data is encrypted on the sender's device and only decrypted by the intended recipient across distributed endpoints.
• Identity-Based Access Restrictions - Restricts secure channel establishment by requiring authorization of the peer's cryptographic identity.
• End-to-End Encryption Protocols - Implements cryptographic standards for securing communication channels with key exchange and forward secrecy across distributed systems.
• Identity Orchestration Frameworks - Provides a framework for orchestrating cryptographic identities and mutual authentication to secure distributed applications.
• Legacy Protocol Tunneling - Wraps legacy TCP or Kafka traffic into mutually authenticated encrypted channels without requiring application code changes.
• Application Identity Management - Generates unique cryptographic identities and handles the enrollment, rotation, and revocation of keys across device fleets.
• Decentralized Identity Authentication - Replaces traditional PKI with decentralized identities and verifiable credentials for mutual authentication.
• Credential Rotation - Updates or cancels active security keys and credentials to maintain system integrity and mitigate compromised identities.
• Identity Management - Creates and maintains verifiable digital identities to ensure privacy and prevent behavior correlation across trust contexts.
• Challenge-Response Verifications - Verifies control of digital identities using signed challenges and tracked key rotation histories.
• Credential Validation - Checks the cryptographic signature of a credential against a trusted issuer to validate subject attributes.
• Identity & Device Management - Generates and manages unique cryptographic identities and verifiable credentials for devices at scale.
• Cryptographic Credential Distribution - Signs and distributes identity attribute attestations via a trusted authority to enable scalable trust across distributed nodes.
• Cryptographic Identity Networks - Implements an identity-based network overlay that abstracts physical connectivity via cryptographic identities.
• Encrypted Message Routing - Sends data through a sequence of intermediate hops using compact binary metadata to define onward and return paths.
• Mutual Authentication - Implements mutual authentication to ensure both communicating parties prove their identities before exchanging data.
• Policy-Based Access Control - Enforces security permissions using a flexible policy-driven authorization engine including attribute and role-based rules.
• End-to-End Encryption - Ensures data remains encrypted during transmission across arbitrary transport paths between distributed endpoints.
• Identity Key Attestations - Signs attestations that link public keys to a specific identity for secure channel authentication or credential signing.
• Authenticated Encryption Channels - Creates secure communication channels using cryptographic key agreement and authenticated encryption to ensure confidentiality.
• Secure Connection Managers - Provides utilities for establishing authenticated and encrypted communication channels between devices and services.
• Non-Human Identity Management - Issues and tracks identifiers, keys, and credentials for devices and cloud services to establish a foundation of trust.
• Session Participant Authorization - Restricts session establishment to participants that match a specific identity or present trusted credentials.
• Verifiable Credential Verification - Validates the signature and authenticity of a credential against a known issuer's identity.
• Stateful Distributed Actors - Creates lightweight, concurrent workers that maintain internal state and process messages via dedicated mailboxes.
• Actor Worker Routing - Sends data to specific worker addresses through a router that resolves locations and manages delivery across different contexts.
• Disconnected - Routes messages between nodes that cannot connect directly due to subnet or protocol mismatches.
• Pluggable Transport Layers - Features a pluggable transport layer to adapt routing protocols to TCP, UDP, and WebSockets.
• Concurrent Network Workers - Runs lightweight, stateful actors within a node that handle messages and communicate via unique addresses.
• Connectivity Abstraction Layers - Hides complex network layer configurations and provisioning from developers to prevent security vulnerabilities and data leaks.
• Cross-Subnet Routing - Routes traffic between nodes that cannot connect directly due to differing IP subnets or mismatched transport protocols.
• Plugin-Based Transport Extensions - Provides a plugin-based extension mechanism to integrate custom transport protocols like WebSockets or TCP into the routing layer.
• Localhost Service Mapping - Creates a virtual point-to-point TCP connection that makes a remote service appear as a local process for existing applications.
• Network Bridging Relays - Establishes outbound connections to intermediary nodes to enable communication with services in private networks.
• Encrypted Relaying - Provides encrypted relaying to enable connectivity between distributed nodes across disparate networks.
• Multi-Transport Messaging - Exchanges messages bidirectionally across complex, multi-hop paths involving various transport protocols to reach destinations across network boundaries.
• Traffic Routing - Implements multi-hop traffic routing to extend encrypted channels across separate network boundaries.
• Traffic Tunnels - Ships traffic tunnels that encapsulate data streams to connect to private services without open ports.
• WebSocket Transports - Adapts routing protocols to various underlying communication methods such as TCP, UDP, WebSockets, and Bluetooth.
• Multi-Protocol Transports - Adapts routing capabilities to work across different physical or network layers including TCP, UDP, WebSockets, and Bluetooth.
• Network-Layer Process Communication - Enables dedicated secure communication channels between application processes across network hosts without exposing them to the network layer.
• Binary Data Signing - Produces cryptographic signatures using EdDSA or ECDSA to ensure data authenticity and integrity.
• Attribute-Based Service Exposure - Groups workers together to provide specific capabilities and applies attribute-based access control to restrict usage.
• Cryptographic Key Management - Manages the lifecycle of signing keys and session secrets using cloud and hardware KMS.
• Digital Signature Verifications - Checks the validity of cryptographic signatures against public keys to confirm sender identity.
• Cryptographic Key Stores - Provides a secure vault for managing and protecting private keys used in cryptographic operations.
• Layered Secure Tunneling - Wraps secure channels inside other secure channels to provide layered authentication and end-to-end guarantees.
• Hardware Security Module Integrations - Integrates with hardware security modules and secure enclaves to perform cryptographic operations and store keys.
• Kafka Security Integrations - Secures Kafka communications by wrapping traffic in encrypted tunnels to verify trust between clients and clusters.
• Automated Key Rotations - Automatically rotates symmetric session keys based on message counts to maintain forward secrecy.
• Hardware-Backed Key Storage - Integrates with secure enclaves and cloud KMS for hardware-backed storage of private keys.
• Local Private Key Stores - Integrates with cloud KMS and hardware enclaves for secure persistence of private keys.
• Network Traffic Filtering - Implements network traffic filtering to authorize or block messages based on route metadata and specific addresses.
• Secret Security - Ensures secret keys never leave secure hardware or cloud management vaults.
• Secure Database Access - Provides secure, encrypted tunneling for database clients to access private database instances.
• Secure Node Provisioning - Creates and manages asynchronous execution environments that run secure protocols and route messages locally or across remote endpoints.
• Secure Remote Access - Establishes end-to-end encrypted tunnels for secure remote access to private clusters.
• Cluster Identity Trust Establishment - Establishes trust relationships using cryptographic credentials issued by a trusted common authority to secure node communication.
• Enrollment Protocols - Uses enrollment protocols and trust anchors to scale trust from a single authority to thousands of distributed entities.
• Verifiable Credential Storage - Saves validated credentials into a local store for future retrieval and use during authorization.
• Overlay Networks - Library and application for sharing local services privately.
• Rust Projects - Listed in the “Rust Projects” section of the Awesome For Beginners awesome list.

Star history