I published Unmoor, an experimental encrypted, authenticated UDP terminal and file transport for Linux and macOS.
The basic idea is not new. Mosh already demonstrated how useful it is for a remote terminal to survive address changes and unreliable networks.
Unmoor explores a different set of trade-offs around that general problem.
The session is identified by a cryptographic identity rather than an address tuple, so an address or NAT change doesn’t end it; the session can resume once a usable UDP path exists again.
One difference is how terminal data is handled. Mosh synchronizes terminal screen state, so intermediate output does not necessarily have to arrive. Unmoor instead repairs the byte stream: once a terminal byte has been admitted by Unmoor, it is either delivered exactly or retained for repair. If retained history fills, the sender applies backpressure rather than silently dropping admitted bytes, which can block the producing command until the receiver catches up.
The bootstrap is also somewhat different. SSH authenticates the initial exchange, but it carries public records rather than an Unmoor traffic key. Each endpoint derives fresh session keys locally using hybrid X25519 + ML-KEM-1024 key agreement.
Post-quantum key agreement is required by default. Explicit --pq=prefer and --pq=off modes allow downgrades when needed, and rekeys use the same hybrid exchange.
After bootstrap, terminal and file traffic runs over encrypted, authenticated UDP.
A few other properties:
- a listener adopts a new return address only after a fresh authenticated packet advances the replay window, so a replayed packet can’t redirect the session
- multiple authenticated UDP legs can belong to one session
- single-file push and pull verify the whole file before installing it atomically; a partial destination is never reported as success
- on Linux, the client confines itself by default using no_new_privs, Landlock and seccomp
- the client reports SYNC, OUT-OF-SYNC and STALLED rather than pretending a gap was delivered
“Multiple legs” does not necessarily mean multiple physical network paths. Different UDP source ports can exercise different RSS/ECMP choices, but that alone does not prove path diversity.
Unmoor is also not a VPN, relay or NAT hole-puncher. The client still needs to be able to reach the listener’s UDP port.
It needs no root, capabilities or kernel module. With the normal SSH bootstrap it also needs no separately provisioned Unmoor key; existing SSH credentials authenticate the introduction.
This is version 0.1.0 / protocol v1. It is experimental and has not had an external security audit.
It is not intended to be exposed as a public service endpoint, and protocol v1 may change without a compatibility promise.
The project was developed end-to-end with AI assistance across implementation, specification, tests, reviews and documentation. The material design decisions and responsibility for what was accepted remain mine. That provenance should be part of how the code is evaluated.
To build and exercise it:
git clone https://github.com/nmicic/unmoor
cd unmoor
make -j2
make check
make smoke
make smoke performs a real post-quantum bootstrap over loopback UDP with a live PTY.
For a first remote run, see the repository’s usage instructions. The protocol and design notes, security limitations and tests are there as well:
Top comments (0)