A cold-start capsule. This side teaches the wire format by hand; the reverse side carries the full reimplementation guide as fountain-coded QR codes. Scan any ~32 of the 52 codes to rebuild it — a torn or partly-scanned sheet still recovers.
| Purpose | Algorithm | Reference |
|---|---|---|
| Signatures / identity | Ed25519 | RFC 8032 |
| Key agreement | X25519 | RFC 7748 |
| Sealed-box AEAD | XSalsa20-Poly1305 (NaCl crypto_box) | NaCl |
| Symmetric AEAD | ChaCha20-Poly1305 / XChaCha20 | RFC 8439 |
| Hashing (IDs, addresses) | SHA-256 | FIPS 180-4 |
| Ratchet KDF | BLAKE2b | RFC 7693 |
| Off | Size | Field | Notes |
|---|---|---|---|
| 0 | 1 | ver | 0x01 |
| 1 | 1 | typ | 0 DATA · 1 INV · 2 WANT · 3 ANNOUNCE |
| 2 | 1 | flags | 0x01 ENC · 0x02 SIGNED · 0x04 FRAG · 0x08 ACKREQ · 0x10 FLOOD · 0x20 SRC8 |
| 3 | 1 | hops | TTL, decremented by relays |
| 4 | 4 | expiry | unix seconds |
| 8 | 8 | dest | address; all-zero = public |
| 16 | 32/8/0 | src | if SIGNED: 32-byte key (or 8-byte addr if SRC8) |
| … | 2 | plen | payload length |
| … | plen | payload | |
| … | 64/0 | sig | if SIGNED |
SHA-256(pubkey)[..8]. Topic = SHA-256(name)[..8].SHA-256(envelope with hops byte = 0)[..16] (over the bytes incl. sig).Ed25519(sk, body with hops=0, no sig); append the 64-byte signature.~S1.base32(wire).base32(SHA-256(wire)[..4])~ (RFC 4648, no padding).Decode: each QR is base64 of a binary fragment
"SP" · ver(1) · origLen(4) · K(2) · B(2) · seed(4) · block(B). Any ~K
independent fragments solve a K×K linear system over GF(256) (primitive poly
0x11d): derive each fragment's K coefficients from its seed (splitmix32),
Gauss-Jordan eliminate, concatenate the K blocks, trim to origLen, gunzip, and
check the SHA-256 above. The reference decoder is
site/seed/decode-seedsheet.mjs.