Security → Transport

Transport

SSH (via the russh library) is TunnelCrib's only encryption and authentication layer for Service traffic, in every connectivity tier.

Tier 0 — UDP + KCP

• Each endpoint gathers up to 16 IPv4 address candidates from its interfaces, including private LAN and VPN addresses, and adds the externally observed ip:port from a fixed magic-byte STUN-style probe when available. The probe is not RFC 5389 and has no transaction IDs or authentication; it exists only for address discovery.
• The endpoints exchange these candidates through the Central Server's authenticated, signed control channel. This reveals the advertised interface addresses to the paired endpoint and the Central Server, even if UDP setup later fails. The selected peer addresses may be included in organization Tunnel audit events, and server debug logging may include candidate payloads.
• The same local socket used for STUN discovery is reused for the UDP hole punch, avoiding a different NAT-mapped port from rebinding.
• KCP (reliable UDP) carries the SSH byte stream unmodified once a candidate path succeeds. Candidate addresses only select where to send packets; the SSH handshake, host-key pinning, and public-key authentication run exactly as they would over TCP.

Tier 1 — TCP simultaneous-open punch

• Both peers dial each other from the same locally bound port they are listening on (SO_REUSEPORT), racing an outbound connect against inbound accepts.
• Because simultaneous-open can yield more than one candidate stream, each is verified with a mutual handshake-echo before being handed to SSH, so a stray or phantom stream cannot be used.

Tier 2 — Relay

• The Central Server (or a delegated TunnelCrib Relay) spawns a per-session tunnelcrib-bridge process with two fresh ED25519 keypairs — one for the Client, one for the Agent — used only for that session.
• The Bridge accepts exactly two SSH connections, authenticated by those per-session keys, and forwards direct-tcpip (Client-side) to forwarded-tcpip (Agent-side) channels only. No shell, exec, or PTY access is possible through the Bridge.
• The Bridge exits automatically on a configurable timeout (default 30 minutes) or when the session ends. See what the Relay can see for what this means for payload visibility.

Session identity pinning

Regardless of tier, every Direct Tunnel's SSH layer pins a per-session Client public key and, after first use, the Agent's host key. This is independent of the Central Server's registration/nonce handshake, so a Direct Tunnel session cannot be impersonated even if transport-level address exchange were spoofed.

Last reviewed 2026-10-22.