Swarm SDK

XSalsa20-Poly1305 symmetric encryption with shared swarm key. PKCS7 padding hides message length. Ed25519 signatures authenticate sender. 10,000+ encrypt/decrypt ops per second.

Peer-to-peer with no central coordinator. Fanout of 3, TTL of 5 hops, 50K message dedup window. 2-second heartbeats detect lost drones within 10 seconds. Mesh self-heals around node loss.

Signal-spec forward secrecy. HKDF-SHA256 chain ratchet derives per-message keys. DH ratchet provides post-compromise recovery. Capture a drone today, past and future messages stay encrypted.

Native MAVLink v2 adapter for PX4, ArduPilot, MAVSDK. Auto-fragments messages into 253-byte ENCAPSULATED_DATA packets. 5-second reassembly timeout. ~128 bytes usable plaintext per packet.

ML-KEM-768 (NIST FIPS 203) + X25519 hybrid key exchange. Both classical and quantum-resistant algorithms must be broken to compromise a session. CNSA 2.0 compliant. Ships today.

HMAC-SHA256 with shared DH secret replaces Ed25519 signatures. Both parties can produce the same MAC — plausible deniability for sensitive operations. Wire format FLAG_DENIABLE (step 0x04).

Signal Sender Keys protocol for O(1) multicast. Each member creates a chain key, encrypts once for the group. Per-message forward secrecy via chain ratchet. Handles packet loss with bounded skip-ahead.

Ephemeral X25519 keypair hides sender identity from network observers. Only the recipient learns who sent the message. Each message uses a fresh keypair — completely unlinkable.

Programmatic control over Double Ratchet sessions. List, inspect, and securely destroy sessions. Reset overwrites key material with zeros before GC. Auto-reinitializes on next send.

Encrypted unicast with delivery confirmation. Automatic retransmission with exponential backoff (5s → 10s → 20s, max 3 retries). Background asyncio loop handles retransmit. on_ack and on_timeout callbacks.

Full lifecycle for one-time prekeys. Generate bundles, consume on session init, auto-refresh when count drops below threshold. Non-colliding IDs across refreshes. Prevents OTP exhaustion in high-churn swarms.

Remove a member and rekey the group with a fresh chain key. Old key overwritten with zeros. New epoch distributed via encrypted unicast to remaining members. Evicted member loses all future access.

Signal-spec X3DH key agreement wired into SwarmAgent. Asynchronous session init from prekey bundles — message offline drones, establish Double Ratchet on first contact. Signed prekey verification prevents MitM.

SHA-256 message dedup across all decrypt paths: standard, sealed sender, deniable, and group. 10K-message bounded window with O(1) eviction. Prevents replay attacks on every protocol mode.

Real-time peer classification (friendly / unknown / suspect / hostile) with behavior-based reputation scoring. Detects 8 threat types: Sybil clusters, RSSI anomalies, rate floods, replays, rogue announces, session anomalies, invalid signatures, and unknown swarm encounters. Auto-quarantines hostile nodes — quarantined peers excluded from mesh gossip fanout. Reputation time-decay prevents permanent blacklisting; inactive peers recover toward neutral. Exports mesh topology as networkx-compatible graph.

Coordinates EW operations across the swarm: 5 modes (JAM, SPOOF, LISTEN, DECEPTIVE, SCAN). Full task lifecycle (pending → active → completed/aborted). Wire format with 0x4557 magic bytes. Spectrum awareness sharing and coordinated timing via mesh consensus. The SDK coordinates which nodes do what, when — hardware does the RF.

Active defense against crypto and RF attacks. Per-peer rate limiting with 4-stage escalation (ALLOW → THROTTLE → DROP → QUARANTINE). Cryptographic canaries detect MitM tampering. Decryption failure tracking triggers emergency key rotation. Auto-quarantine release with exponential backoff (5 min → 1 hour max). All thresholds configurable via ExtensionConfig (20 validated parameters).

Passive tracking using RSSI time-series, multilateration from 3+ observers for position estimates, and movement prediction from signal trends. Communication pattern fingerprinting classifies drone types (ArduPilot, PX4, DJI, custom). No extra hardware — analyzes signals already received by the mesh router.

Swarm Encounter Detection

SWA detects foreign swarms approaching, classifies unknown nodes via behavior analysis, and auto-quarantines hostiles. Reputation scoring tracks trust over time. Mesh topology export produces networkx-compatible graphs for C2 visualization.

Coordinated Electronic Warfare

EW coordinator distributes jam/spoof/listen/deceptive/scan tasks across the swarm with priority-based assignment. Synchronized timing via mesh consensus ensures coordinated operations. Spectrum awareness data shared in real-time across all nodes.

Active Threat Mitigation

Resilience module rate-limits suspicious peers with automatic escalation. Deploys cryptographic canaries to detect MitM tampering in the mesh. Triggers emergency key rotation when compromise indicators are detected. Integrates with SWA for unified threat response.

Passive RF Intelligence

RF tracker builds position estimates from RSSI observations across 3+ drones using multilateration. Classifies drone types (ArduPilot, PX4, DJI, custom) by communication pattern fingerprinting. No additional sensors or hardware required.