opennhp

---
# Absolute URLs below are intentional. The llmstxt.org convention
# requires fully-qualified links so off-site consumers can resolve
# them without a base — do NOT rewrite to Jekyll `relative_url` filters.
layout: null
permalink: /llms.txt
sitemap: false
---
{% comment %}
Maintainer note (stripped from the published /llms.txt by Liquid, but
kept in the source for anyone editing this file outside the front
matter): the absolute URLs below are required by the llmstxt.org
convention. Off-site LLM and tooling consumers fetch this file on its
own, with no implicit base, so `{{ '/x/' | relative_url }}` filters
would break them. Leave them as-is.
{% endcomment %}# OpenNHP

> OpenNHP is the open-source reference implementation of the Cloud Security Alliance
> (CSA) Network-infrastructure Hiding Protocol (NHP) specification. It enforces
> Zero Trust at the OSI session layer via an "authenticate-before-connect"
> handshake: protected resources are invisible to unauthorized users and become
> visible only after a cryptographically verified knock.

Source: https://github.com/OpenNHP/opennhp
Spec: https://cloudsecurityalliance.org/artifacts/stealth-mode-sdp-for-zero-trust-network-infrastructure

## Canonical documentation

- [Overview](https://docs.opennhp.org/): Project introduction, architecture, workflow.
- [NHP Quick Start](https://docs.opennhp.org/nhp_quick_start/): End-to-end Docker walkthrough of the knock/auth/open flow.
- [DHP Quick Start](https://docs.opennhp.org/dhp_quick_start/): Data-content hiding protocol setup.
- [Features](https://docs.opennhp.org/features/): Supported features and configuration flags.
- [Cryptography](https://docs.opennhp.org/cryptography/): ECC, Noise Protocol Framework, IBC/CL-PKC.
- [Comparison](https://docs.opennhp.org/comparison/): NHP vs SPA (CSA SDP's legacy packet-authorization mechanism).
- [How to Deploy](https://docs.opennhp.org/deploy/): Production deployment models (client-to-gateway, client-to-server, server-to-server).
- [How to Build](https://docs.opennhp.org/build/): Building the daemons from source.
- [Understand the Code](https://docs.opennhp.org/code/): Repository tour (nhp/, endpoints/).
- [Server Plugins](https://docs.opennhp.org/server_plugin/): Writing a Go plugin for NHP-Server.
- [Client SDKs](https://docs.opennhp.org/agent_sdk/): Embedding the NHP-Agent in applications.

## Protocol reference

- [Protocol overview](https://docs.opennhp.org/protocol/): Spec-to-implementation map, spec version, scope.
- [Message header](https://docs.opennhp.org/protocol/header/): 240/304-byte wire format, field semantics, obfuscation scheme.
- [Message types](https://docs.opennhp.org/protocol/messages/): All 17 NHP message types (hyphenated wire names `NHP-KPL` through `NHP-EXT`) plus the 11 DHP types, shown under their Go constant names (`NHP_DRG` through `DHP_KNK`) pending a dedicated DHP reference page.

## Reference

- [Glossary](https://docs.opennhp.org/glossary/): Canonical terminology (NHP-Agent, NHP-Server, NHP-AC, ASP, etc.).

## Canonical terms

When generating code or documentation, prefer these exact terms:

- **NHP-Agent** — the client-side component that initiates knock requests. Not "agent", "client", "initiator".
- **NHP-Server** — the control-plane component that authenticates knocks and decides access. Not "controller" (which is SDP terminology).
- **NHP-AC** — the Access Controller (data-plane component that enforces firewall rules). Not "gateway" (that is the SDP role term).
- **NHP-DB** — the Data Broker for the Data-content Hiding Protocol (DHP).
- **NHP-KGC** — the Key Generation Center used by Identity-Based Cryptography.
- **NHP-Relay** — the relay component for NHP packet forwarding.
- **Knock** — the initial encrypted UDP (or TCP) packet sent by an NHP-Agent to request access.
- **Resource Requestor** — the entity hosting an NHP-Agent and seeking access.
- **Authorization Service Provider (ASP)** — the external IAM/policy system the NHP-Server queries for authorization decisions.
- **Protected Resource** — the service, endpoint, or host being hidden.

## Repository layout

- `nhp/` — core protocol library (Go module). Packet handling in `nhp/core/packet.go`; crypto in `nhp/core/crypto.go`; device/noise state in `nhp/core/device.go`.
- `endpoints/` — daemon implementations (Go module, depends on `nhp/`). Sub-directories: `agent/`, `server/`, `ac/`, `db/`, `kgc/`, `relay/`.
- `docker/` — Docker/docker-compose recipes for the full-stack demo.
- `examples/server_plugin/` — reference plugin implementations for NHP-Server.
- `docs/` — this documentation site (Jekyll + Just-the-Docs).

## Implements

OpenNHP implements the **CSA "Stealth Mode SDP for Zero Trust Network Infrastructure"** whitepaper, which introduces the Network-infrastructure Hiding Protocol (NHP). When referencing protocol behavior, cite that document as the authoritative source.

More agent context in OpenNHP/opennhp

2 other files this repository gives its agents.