// about the protocol
Reticulum is a network stack for messages and data across multiple transports at once. You can use the same identity over the internet, LoRa, WiFi, Bluetooth or packet radio, and the network decides for itself how traffic travels best.
Reticulum is not an app, but the layer underneath. Apps like Ratspeak and Sideband use that layer to find each other, deliver messages and later also work over radio once you add hardware for it.
On IP networks you send data to an address and a port. In Reticulum, applications create destinations. A destination is a cryptographic endpoint with a 16-byte hash. That is what the network routes towards.
When a destination wants to be reachable, it sends an announce. Transport nodes that hear that announce learn the next hop back to that destination and can forward the announce. No single node needs to know the whole network, only the next step.
When two endpoints need a private session, Reticulum sets up a link: an encrypted, temporary channel that can span one or more hops. Messaging applications add LXMF on top of that: message structure, signatures, direct delivery and store-and-forward propagation.
Reticulum vs traditional
Traditional (IP) App → IP address:port → DNS → routing tables → server Reticulum App → destination hash → announce-based routing → encrypted link
Destinations replace IP addresses. A Reticulum address is not a place in a subnet. It is a hash derived from an identity and an application name. Create as many as you like, whenever you like.
The medium does not matter. Reticulum packets travel over slow LoRa, local WiFi, TCP over the internet, I2P, serial and other carriers, in the same network. Interfaces are adapters; the packet and routing model stays the same.
Routing is learned from announces. There is no DNS, DHCP, certificate authority, central registry or mandatory account provider.
Encryption is always on. Messages and links are end-to-end encrypted, and you cannot switch it off. Only announces travel unencrypted, but they are signed. Packets carry no source address, so the packet itself does not reveal who sent it. The destination address does travel unencrypted.
| Function | Primitive |
|---|---|
| Key exchange | X25519 (ECDH on Curve25519) |
| Encryption | AES-256-CBC with PKCS7 |
| Signatures | Ed25519 |
| Authentication | HMAC-SHA256 |
| Key derivation | HKDF |
| Identity keys | 512-bit Elliptic Curve (X25519 + Ed25519) |
Encryption is built in, there is nothing to switch on. More detail and the exact primitives are on the encryption page.
A Reticulum identity is a 64-byte private keyset: 32 bytes for X25519 key agreement and 32 bytes for an Ed25519 signing seed. One is created automatically the first time you start up. Treat it like an SSH key. Whoever holds the private key can act as that identity.
From the public key a destination hash is derived. 16 bytes, shown as 32 hex characters. That is your address on the network. Safe to share, because it is derived from your public key.
# Example destination hash
4faf1b2e0a077e6a9d92fa051f256038
You can create a new identity at any time. Using several identities at once is fine too: one for friends, one for work, one for a project.
Not every Reticulum node does the same thing. By default you are a regular node. The other roles you switch on deliberately.
| Type | What it does | Config |
|---|---|---|
| Regular node | Sends and receives only its own messages. The default after installation. | default |
| Transport node | Also forwards other people's traffic. Enables multi-hop reachability. | enable_transport = yes |
| Propagation node | Stores LXMF messages for offline users. Delivers them once they come back. | lxmd -p |
You do not have to be a transport node to communicate. Volunteers who want to extend the network switch that role on.
In practice you often see two layers: a backbone of transport nodes over the internet, plus local mesh segments over LoRa. Gateway nodes connect those layers together. That way you can start small and still expand to radio or local coverage later.
Local LoRa mesh Global backbone Local LoRa mesh (no internet) (over internet) (no internet) [Node A] --radio--+ +--radio-- [Node E] | | [Node B] --radio--+-- [Gateway] ==internet== [Gateway] --+--radio-- [Node F] | | [Node C] --radio--+ +--radio-- [Node G]
Networks can be open or closed. With a shared passphrase (IFAC) you can set up a private network that is invisible to outsiders. All announces and packets are then filtered.
Reticulum packets are compact. At most 500 bytes, a fit for LoRa and other media with limited bandwidth.
[HEADER 2B] [ADDRESSES 16/32B] [CONTEXT 1B] [DATA 0-465B]
| Packet type | Size |
|---|---|
| Path Request | 51 bytes |
| Announce | 167 bytes |
| Link Request | 83 bytes |
| Link Keepalive | 20 bytes |
Not a replacement for physical connectivity. If no radio, cable, LAN, internet tunnel or propagation path connects two regions, packets cannot bridge the gap.
Not anonymity software. Reticulum leaves source addresses out of packets and supports initiator anonymity, but that protects the sender, not the receiver. The destination address sits unencrypted in the header, on every medium. Over LoRa, anyone within radio range sees which address you are sending to. Over the internet, your provider and the operator of the node you connect to see the same thing, plus your IP address, because TCP interfaces do not use TLS. Addresses can be linked to names once announces carrying a name have passed by. On a private interface with a passphrase (IFAC) the whole packet is masked, including the address. Timing, physical-layer observation and operational mistakes leak information too.
Not automatically store-and-forward. Reticulum provides the network layer. LXMF propagation nodes provide offline message storage. Without a propagation node, messages are not kept for offline recipients.
Not limited to off-grid radio. Reticulum works just as well over Ethernet, WiFi, TCP, UDP, I2P or a mix of those. You need LoRa and RNodes if you also want to work without the internet.
| Language | Project | Status |
|---|---|---|
| Python | Reference implementation (Mark Qvist) | Original, community-maintained |
| Rust | rsReticulum (Ratspeak) | Active, basis of the Ratspeak apps |
| Rust | Leviculum | Community implementation |
| C++ | Embedded implementation | Microcontrollers |
| Go | Community implementation | In development |