FIPS · design proposal · not implemented

One packet to reattach.

Every FIPS router broadcasts the same open SSID — !FIPS — so phones roam between them like one big network. The session already survives the hop; what costs time is rediscovering where to send. If each router derives its IPv6 prefix from its own identity, the router advertisement the phone must receive anyway names the router — and the first packet can be the reattach.

reattach clock 0 sim ms
1/7

Clock counts simulated milliseconds from the moment the old link dies. In fast-path mode the phone pre-warms sessions with B and C through the mesh while still on A — a peer link needs a radio path, but a session only needs reachability — so the hop binds an existing session to a new link. Old traffic drains through A over the backhaul while routing converges. A cold attach (no warm session) costs one extra round trip: IK msg1 goes straight to the derived address, still zero discovery.

The trick

FIPS already maps identity to IPv6: the overlay address on fips0 is fd | SHA-256(pk)[0..15] (src/identity/address.rs). The access prefix is the same address, truncated to /48 — no new derivation, no registry, and nothing to distribute: any FIPS address the phone already holds names that router’s access network too. One identity address, two scopes — all 128 bits route through the mesh, the first 48 bits rendezvous on the radio link.

router B · at fips-ap-setup time
overlay = fd | SHA-256(pk)[0..15]   # /128 — exists today
access  = overlay[0..48]            # truncate
addr    = access:fa00+radio::1      # in every RA
phone · existing knowledge
known = peers · .fips lookups · sessions
each FipsAddress → access /48       # free
on RA: announced /48 ∈ known set ?
match  ⇒  dst = access:fa00::1
live session → one authenticated packet resumes it (no re-auth)
cold attach  → IK msg1 needs the pubkey: resolve addr→npub over the
               overlay beforehand, or fall back to mDNS on-link

Why it’s safe

A hint, not an authenticator

A forged RA attracts exactly one packet, which fails authentication — resume packets fail the session MAC, and IK msg1 is encrypted to the real router’s key. The phone falls back to mDNS discovery.

Nothing new leaks

npubs are already broadcast in transport beacons and mDNS adverts on the same link. Making the prefix derivable adds no linkability that isn’t already in the air.

Collisions don’t matter

40-bit IDs over n candidate neighbors collide with ≈n²/2⁴¹ probability. At realistic neighbor counts that’s negligible — and an ambiguous match just tries both; the handshake decides.

Status & dependencies