FIPS networking glossary

Addresses and connectivity

Term Meaning
IP address Network address of a device or interface. It is not the device's cryptographic identity.
Private / LAN address Address used inside a local network, such as 192.168.1.20. Usually unreachable directly from the internet.
Public address Address visible on the internet. With NAT it often belongs to the router, rather than directly to your computer.
Port Number identifying a network endpoint on a host. An IP address plus port identifies where to send UDP packets.
Socket An application's local network endpoint. Keeping the same UDP socket open matters during discovery and punching.
UDP Datagram protocol used by our direct transport. Packets can be lost, reordered, or duplicated; sending alone does not acknowledge receipt.
NAT Network Address Translation: a router rewrites private addresses/ports to public ones, often allowing many devices to share a public IP.
NAT mapping Association between a local socket and the external address/port assigned by a NAT router. It can expire or vary by destination.
CGNAT Carrier-grade NAT operated by an ISP, outside your home router. Home-router port forwarding alone may not make a device publicly reachable.
Firewall Rules allowing or blocking traffic. A firewall and NAT are different mechanisms, though home routers commonly provide both.
STUN Session Traversal Utilities for NAT. A server reports the source address/port it observes for a UDP request. It neither forwards app traffic nor guarantees reachability.
Reflexive candidate Public address/port observed through STUN for a particular socket and destination.
Local candidate Address/port on a local interface, potentially useful when peers share a LAN.
UDP hole punching Both peers send outbound packets toward each other's candidate endpoints to try to establish compatible NAT/firewall state. Success is network-dependent.
Port forwarding Manual router rule directing incoming traffic on a public port to a local device/port. Requires transport support for a stable listening endpoint.
TURN Traversal Using Relays around NAT: a relay service that can forward traffic when direct traversal fails. Not implemented by this plugin; a STUN server is not automatically a TURN service.
RTT Round-trip time: elapsed time for a request and reply. /fips ping measures an application-level encrypted roundtrip.

Discovery, trust, and protocols

Term Meaning
Signaling Small coordination messages used to establish a connection, rather than the ongoing application data.
Nostr relay Server that receives and distributes Nostr events. In this plugin it carries discovery adverts and encrypted traversal signaling.
Kind 37195 advert Signed, addressable Nostr event describing FIPS transport options and signaling relay hints. See the example.
Kind 21059 signal Outer event used by this transport's encrypted, gift-wrap-style traversal offer/answer exchange.
Kind 10050 Nostr DM inbox-relay list. Not the same as a FIPS advert; unnecessary for a flow that gets its relay hints directly from manual invites.
Candidate exchange Peers privately share possible UDP endpoints through encrypted signaling.
Roster Locally stored list of permitted peer identities and their claimed human owners. Both peers currently need the other in their roster.
Master identity Human owner's Nostr identity. A roster association alone does not prove the owner signed it.
FIPS identity Dedicated cryptographic identity of this plugin instance, distinct from the bot and master identities.
FMP FIPS Mesh Protocol: authenticates and encrypts links between adjacent nodes using Noise IK.
FSP FIPS Session Protocol: provides end-to-end sessions between application endpoints using Noise XK.
Noise handshake Cryptographic exchange establishing authenticated encryption keys; independent of whether UDP probes reached a host.
FIPS forwarding node Node that forwards FIPS packets through a mesh. Distinct from a Nostr relay or STUN server.
WebSocket seed Compatible FIPS WebSocket endpoint used to enter a mesh. An ordinary Nostr relay URL is not a FIPS seed.
Service port Application identifier inside FIPS (4200 for our app envelopes, 4201 for ping). Not a router port to forward.

See architecture and relay selection for which mechanisms the current plugin actually implements.