A messenger that keeps working as conditions degrade
Sytrep carries voice, text and media over whatever link exists — fibre, Bluetooth, a LoRa radio on a ridge, a phone screen held up to a camera. Messages survive partitions of hours, hand off mid-flight between bearers, and can travel with no infrastructure at all.
Apache-2.0 · Two backend binaries, zero external services · No default relay, deliberately
- Security
- Anonymity
- Decentralisation
In that order, on the occasions they conflict.
Two desktop clients can hold a conversation through a relay, over a hybrid post-quantum handshake and a real ratchet, and the conversation now survives quitting the application. Only the internet and BLE bearers are implemented — BLE as framing against a simulated radio — and there is no mobile client yet.
This is something to run and read, not something to rely on. The full status, step by step →
Not another Signal
The distinguishing property is not the cryptography — good constructions are published and adoptable. It is that the network is built for links that appear, vanish, and differ from each other by four orders of magnitude.
Pluggable bearers, individually gated
QUIC, BLE, Wi-Fi Direct, LoRa, animated QR, an acoustic packet modem, NFC and SMS. Each is toggleable with a user-defined fallback order, and every one is gated by a privacy floor that will not silently downgrade you.
A delay-tolerant network
Not a messaging app with transport options. Store-carry-forward with mid-flight bearer handoff, fragmentation that resumes across a bearer switch, and latency classes on every payload. A message may start over BLE and finish over QUIC.
Peer carry
Clients optionally relay strangers' encrypted traffic, so messages propagate by physical human movement plus short-range radio. Opt-in, quota'd, bounded replication — and the carrier learns neither sender nor recipient.
Hybrid post-quantum throughout
Classical and post-quantum concatenated, never post-quantum alone, so the construction holds if either survives — and every primitive stays swappable by negotiated ciphersuite ID. How it stays affordable on a 7 B/s bearer.
0.3 kbps to 250 Mbps, behind one send button
Every bar is a bearer the design has to hold at once. This span is why the delivery layer is a delay-tolerant network rather than a socket with retries: at the left-hand end a photo is a 200-byte glyph that silently upgrades to full resolution the next time both parties are on QUIC.
Sustained throughput, logarithmic
Colour is privacy level, and the words for it are on the bearer pageSMS/MMS is not shown because it has no meaningful sustained rate — it is 140 bytes per segment, and it hands a carrier the record that two phone numbers communicated. It stays in the design as a censorship-resistant last resort and is never an automatic fallback.
One message, four hours, three bearers
Fragment identity is bearer-independent, so a transfer interrupted on one link resumes on the next rather than starting over. Waiting is the normal condition in a delay-tolerant network, and the interface says so — a queued message is never coloured as an error.
-
09:14 · café
Queued, then BLE
Composed offline. The policy engine picks the first bearer that appears and can carry it.
-
09:41 · out of range
Carried
A stranger's device holds the remaining fragments as an opaque, rotating mailbox ID.
-
11:02 · ridge
LoRa, adapted
The photo goes as a glyph. Airtime is charged against a duty-cycle budget before it is sent.
-
13:20 · home
QUIC, upgraded
Full resolution arrives against the same content hash. Delivered — not resent.
Peer carry
Your device holds ciphertext it cannot read
On meeting, nodes exchange a Bloom filter of the mailbox IDs they want, rather than asking "do you have anything for X?" — which would let anyone probe for the presence of a recipient. Each message carries a decrementing replication budget, so it reaches at most K carriers rather than everyone.
Defaults are non-negotiable: a 200 MB storage quota, a 7-day TTL the carrier enforces regardless of what the sender asked for, never over metered connections, never over LoRa without explicit consent, and your own traffic always preempts carried traffic.
Legal exposure, disclosed
This is not an exit node
Carried traffic moves only between nodes inside this network and never egresses to the open internet. The failure mode that makes running a Tor exit hazardous — your address appearing in a third party's abuse logs — structurally cannot occur. The closer analogy is a middle relay.
Mere-conduit protections generally apply, but this is not uniformly settled, so peer carry is opt-in and off by default, with a plain-language explanation at the point of enabling.
Preference never overrides physics or safety
A first-class subsystem, not a settings screen. You enable and disable bearers and set the fallback order; four properties hold regardless of what you set.
Privacy floor
You set a minimum acceptable privacy level, and bearers below it are never selected whatever the ordering says. This is what prevents it silently fell back to SMS and deanonymised you.
Capability before preference
You may rank LoRa first. A 4 MB photo still will not go over it — it queues for a capable bearer instead of being truncated or refused.
Consent gates
SMS/MMS and direct peer-to-peer are marked as requiring consent: per-contact, sticky once granted, revocable, and surfaced at send time rather than buried in configuration.
Airtime accounting
Capability returns a cost in airtime seconds, not a boolean. EU 868 LoRa is legally capped at a 1% duty cycle and the engine enforces it — and you see this photo will take four minutes before committing.
A human may choose which bearer. A human may not choose to transmit in the clear unknowingly.
Contact exchange does not go through the engine — nobody enqueues a contact bundle and lets a resolver pick a bearer, they tap two phones together or hold up a camera. That path exists, and it is a closed list of operations where a person is physically present. Fallback order, the privacy floor as a filter, and global enable are all preferences, and directly choosing a bearer overrides them. Duty-cycle limits, cleartext disclosure, end-to-end encryption and capability limits are invariants, and hold on every path.
Two binaries, zero external services
No coturn, no Postgres, no Redis, no load balancer. A relay is a single process with an encrypted store; a client is a single binary that works without one.
A relay
cargo run -p sytrep-node -- \
--listen 0.0.0.0:4433 \
--store relay.redb \
--store-key $(openssl rand -hex 32)Mailboxes over QUIC, TTL'd opaque blobs, destructive collection, and a background expiry sweep. Before you run one, read docs/RUNNING-A-RELAY.md — including why you may not want to run one alone.
A client
# no relay needed
cargo run -p sytrep-desktop
# one relay
cargo run -p sytrep-desktop -- --relay 127.0.0.1:4433
# redundancy, not load balancing
cargo run -p sytrep-desktop -- --relay a:4433 --relay b:4433Identity, contacts and the queue are all local. Add a relay from the Relays view at any point.
Several relays
Redundancy, not load balancing
Every deposit goes to all of them and collection reads from all of them, so delivery works as long as you and the person you are messaging share at least one. A relay that stops answering is rested for a minute and retried, never dropped. The cost is that each extra relay is another operator who learns a deposit happened.
No default relay
Deliberately not configured for you
There is no built-in relay address. A client that silently deposits into somebody else's relay has chosen a party to trust on the user's behalf — so the client starts with none, and messages simply wait until you add one or a bearer appears.
Claiming protection that does not exist is worse than claiming none
Because a reader stops looking.
Three things the threat model does not defend against
A global passive adversary correlating traffic worldwide — defeating that needs a mixnet, which makes voice unusable. Endpoint compromise: a rooted phone with a keylogger defeats every design. And traffic-volume analysis, so a watching adversary can tell you sent something large.
Reasonable objections
Can I use this today?
Only to run and read. Two desktop clients hold a conversation through a relay over a hybrid post-quantum handshake and a real ratchet, and sessions now persist across restarts. The internet bearer works; BLE has its framing implemented and verified against a simulated radio, with the radio itself pending. There is no mobile client, no anonymity layer yet, and no voice. Status, step by step.
Why not just use Signal?
For most people, most of the time, you should. Sytrep is aimed at the case Signal does not address: no internet, no cell coverage, no infrastructure at all. Where it borrows a solved construction it borrows it — the Double Ratchet from the published spec, MLS via openmls for groups, ICE for NAT traversal, BIP39 and SLIP-39 for backup. Novel cryptography is a cost, not a feature.
Is SMS support not the opposite of the whole point?
It is the explicit tension in the design and it is kept visible rather than smoothed over. SMS hands the carrier a record that two phone numbers communicated — precisely the metadata the rest of the system exists to hide. It stays as a censorship-resistant last resort, sits at the bottom of the privacy ramp, is gated behind per-contact consent, and is never selected automatically.
Why does a mode exist that sends in the clear?
Amateur radio prohibits encryption. The Part 97 profiles — lora-open and acoustic-open — are signed but not encrypted, so licensed operators can use the network legally. Rather than dimming them to the bottom of the privacy ramp, the interface strikes them out and writes CLEAR beside them, the way a proof is marked not to print. Rendering cleartext as one step less private would be a lie told in colour.
If I carry other people's messages, what am I holding?
Ciphertext you cannot inspect and did not author, addressed to a rotating identifier that is meaningful only to someone who already knows the recipient's identity key. It never leaves this network for the open internet, so the exit-node risk does not arise. It is off by default, quota'd, and TTL'd by you rather than by the sender.
Does choosing maximum anonymity make me stand out?
It would, which is why tier choice is not observable on the wire. All four identity tiers produce byte-identical handshakes and message framing; the differences exist only in what you opt to publish to discovery mechanisms, and the registry and lookup services are strictly additive — never part of the message path.
Where is the source?
Apache-2.0, in a private repository for now. The protocol specification documents every byte that crosses a bearer, and the architecture document records the decisions that should not be relitigated without reason, along with numbered open questions that carry deadlines.