Decent Newsroom
Sign In

FIPS Project Update and v0.5.0 Release

By FIPS September 3, 2026
We've got exciting news for you, another FIPS release! New features, new platforms and many, many bugfixes! We've landed the first version of the native API that lets you interact with other nodes over FIPS directly, without going through IP first. Android and FreeBSD are now supported and much more.

We’ve got exciting news for you, another FIPS release! New features, new platforms and many, many bugfixes! We’ve landed the first version of the native API that lets you interact with other nodes over FIPS directly, without going through IP first. Android and FreeBSD are now supported and much more.

Notable Contributions

  • Johnathan Corgan - @jmcorgan.

    • Johnathan has restructured the FIPS codebase to follow the Sans-IO pattern, which completely separates business logic (the protocol logic) from IO operations. This makes the protocol logic all synchronous, which is a very important requirement to make it portable to embedded systems like ESP32.
    • This release includes the native API, which allows FIPS-aware applications to utilise all features that FIPS brings to the table, like dynamic MTU and the socket file descriptor, which means you can hand a connection to an isolated application. Read more on that below.
    • We have received multiple security-reviews in the past couple months, which have resulted in a large number of security-patches that are included in both v0.4.2 and v0.5.0 releases. No critical issues were uncovered.
    • The new fipsctl probe utility allows you to debug discovery and sessions. More below.

  • Arjen - @Origami74.

    • Arjen worked on allowing a FIPS mesh to form between mesh-capable OpenWrt routers using the 802.11s mesh protocol (#123).
    • The OpenWrt now also includes a !FIPS SSID to bridge mobile (Android) meshes to the larger mesh (#126).
    • Arjen added support for Android build targets along with various changes to enable BLE and Wi-Fi Aware transports on Android (#127, #136).

  • Fr34aky - @fr34aky.

    • fr34aky contributed support for FreeBSD build targets, including the TUN datapath, DNS integration and packaging (#129).
    • The second contribution is a bugfix for BLE interoperability between Linux and Android. Most operating systems assign a BLE (PSM) address, but the Linux implementation assumed a self-assigned static identifier (#139).

  • Martti Malmi - @mmalmi.

    • Martti made macOS nodes a lot faster at moving packets by drastically
      reducing the number of memory allocation operations (#134, #135).

  • Jeff Gardner - @erskingardner.

    • Jeff contributed a fix for an issue where FIPS would chown the parent directory of the control socket in /tmp, which created issues for other processes (#138). First contribution to FIPS.

  • Redshift - @redshift.

    • Redshift contributed bugfixes for macOS where FIPS would rely on Linux directories to exist. He moved the config and socket directories to the correct macOS paths (#132).

What’s in v0.5.0

OS support

We’re excited to let you know there are new operating systems that can now join the mesh!

Android
FIPS now compiles for Android, see more below!

FreeBSD
FIPS now runs on FreeBSD targets, which is a big deal specifically for OPNsense and pfSense routers! The install layout and packaging is very similar to macOS. Currently it is supported on the x86_64 architecture.

NixOS
There was already support for NixOS, but it still required quite a bit of manual setup. This release includes a NixOS module that configures the systemd service, config paths and DNS server.

Android and BLE interop

OS support
Android is now a supported build target, and a lot of work has gone into interoperability. Android is a Linux system but has many restrictions not present in desktop environments. For example: an app embedding FIPS needs to own the TUN adapter, which shows up as a claim on the only Android VPN slot.

We will not ship a FIPS app for Android ourselves in this repo. However, these changes mean that it can be embedded by app developers now. Two Android apps that have included FIPS and informed the design are fips2go and Myco.

Bluetooth LE
We gave the Bluetooth implementation a big overhaul in order to make it work on Android. Again, a few assumptions were broken and we needed to address those. After some more bugfixes, Android phones can now peer with a Linux desktop over BLE.

This means that you can browse the web on a phone in airplane mode with ONLY Bluetooth turned on!

Wi-Fi Aware
Though it’s not an embedded feature in FIPS, it’s worth mentioning that most Android phones can peer directly with each other using ‘Wi-Fi Aware’.

Wi-Fi Aware creates an IP tunnel between the phones, which we then use to create a FIPS-over-UDP peering. It achieves regular wifi speeds of 100+ Mbps, way faster than BLE.

Bridging mobile mesh to greater mesh
Working on mobile support is what led to defining a common !FIPS wifi SSID on OpenWrt targets (see below) that can be used to roam around the mesh and bridge mobile devices to the larger mesh. After connecting, it uses mDNS / DNS-SD in order to connect to the node on the router.

Native datagram API

We have a first experimental release of the native FIPS API, an API that lets you benefit from all the FIPS features we cannot expose over the traditional TUN adapter, which we use to interoperate with existing IP-based applications.

This means you can now send traffic from A to B without a single IP being involved, anywhere.

In order to do this you’ll need to call the API from within your application. The API has been modeled after Unix sockets and operates very similarly. Opening a connection gets you a file descriptor, which you can then even hand to a Docker-isolated application.

Delivery is best-effort, so what you’re getting is a UDP-like transmission but with end-to-end encryption, addressed by npub.

If you plan to test this out, check our walkthrough and then how to write a client. You can find more technical details in the reference, and using the API covers turning it on.

fipsctl probe

fipsctl now ships with a probe npub1...xyz command that helps you debug FIPS sessions. It establishes a connection and shows you every step that happens during this process.

When you probe, you get a report on the bloom filters, discovery, session, path and round trip time (ping).

Example output:

fipsctl probe nostr:npub1gd7ye2qp2lphhzx75fynnjzaxx4dqanddecet0wtt5ss5ek8h9ps62wdkf
probe test-us04
  npub       nostr:npub1gd7ye2qp2lphhzx75fynnjzaxx4dqanddecet0wtt5ss5ek8h9ps62wdkf
  node_addr  5d43caa769f6e522bbab83b8021c7887
  ipv6       fd5d:43ca:a769:f6e5:22bb:ab83:b802:1c78

  bloom       ok        0.4s  claimed by a peer filter
  discovery   ok        0.0s  coordinates from mesh lookup
                              attempt 1    replied   (1s)

  session     ok        1.0s  established (XK handshake)
  rtt         ok        2.0s  238 ms round trip

path:
  ours       depth 3    00001a8c > 4f9b4a84 > bace6d8e > ad9d5cb1 [self]
  theirs     depth 1    00001a8c > 5d43caa7 [target]

  route      ad9d5cb1 [self] > bace6d8e > 4f9b4a84 > 00001a8c > 5d43caa7 [target]

  walk       3 up, 1 down   tree distance 4 (upper bound; crosslinks may shorten it)
  next hop   bace6d8e (test-es01)   class tree up
  path mtu   1280 bytes (observed)

  cleanup    session was opened by this probe and has been torn down
  overall    ok, 4423 ms   (stage timings quantized to the 1000 ms tick)

OpenWrt update

The OpenWrt package now ships with a couple of scripts that help you turn your router into a freely meshing device and access point for other devices that want to bridge onto the greater FIPS mesh.

802.11s mesh backhaul
802.11s is a wifi mesh protocol that we can use to create a true wireless FIPS mesh, where nodes associate with any node that is within range, dynamically. There are no Access Points (AP/SSID) to explicitly connect to; it just starts talking ethernet with whoever is close enough.

FIPS just leverages this wifi protocol that is available on most modern routers and handles the routing and encryption. Read how to set it up.

The open access !FIPS SSID
The second script helps you set up a !FIPS open SSID that does nothing other than allow a connected device to reach your FIPS node. No traditional IP access. This also allows a phone to use this network only for FIPS while continuing to use 4G/5G for regular traffic.

The reason for this is to help Android phones bridge Bluetooth peers to the wider mesh. Android doesn’t support the 802.11s mesh described above and also can’t do raw ethernet when connected over wifi. BUT, with a !FIPS SSID + mDNS discovery, the phone can peer with the router, bridging the gap between supported network technologies.

Security comes from FIPS encryption rather than from any wifi encryption standard. Read how to set it up.

To sketch a scenario, chaining radios that can’t talk to each other directly:

  • A BLE-only Android device pairs with a second phone over Bluetooth
  • That second phone has Wi-Fi Aware, and pairs with a third phone over it
  • The third phone is connected to a router’s !FIPS SSID
  • The BLE-only device can now reach anyone in the larger FIPS mesh

Performance improvements

Since v0.4.0 there’ve been various performance improvements, mainly on the macOS front, courtesy of Martti Malmi (#135). There are also some gains on the probing of bloom filters, where we now hash the pubkey once instead of 5 times per membership check. Lastly, all identity operations now share a single secp256k1 context, removing all setup-and-teardown operations on every signing operation.

Bug Fixes

As mentioned before, we’ve received several security reviews for FIPS, which we’re grateful for, and we have addressed the findings immediately. None of the issues broke cryptography or exposed any key material, but many of them needed to be closed: ways to take down node sessions, traffic misattribution, MTU manipulation, etc.

Additionally, many state-machine issues, silent failures that should have been loud, and packaging issues have all been addressed.

Community

We just wrapped up the Sovereign Engineering Cohort (SEC-08) and have seen many interesting developments in what people are building with FIPS: experimentation with the native API like multiplayer pong without IPs, OpenWrt meshes, and Android embeddings.

Getting v0.5.0

Everything is on the v0.5.0 release page:

  • Linux x86_64 / aarch64 — .deb and tarball
  • Arch Linux — fips from the AUR
  • macOS — .pkg
  • Windows — ZIP
  • FreeBSD (x86_64) — .pkg, new this release
  • OpenWrt — .ipk for 24.x and earlier, .apk for 25+. Both carry the
    fips-mesh-setup and fips-ap-setup helpers
  • From source — cargo build --release from a checkout of the v0.5.0 tag
  • Nix / NixOS — nix build .#fips from a checkout of the v0.5.0 tag

There is no Android daemon artifact; Android is supported as an embedded crate,
as described above.

v0.5.0 is wire-compatible with v0.4.x, so nodes can be upgraded in any order. If
you are coming from v0.4.1 or earlier, read the v0.4.2 notes too — most of this
cycle’s security work is in it.

Full release notes are on the release page, and the complete per-commit
changelog is in CHANGELOG.md.

Where to Find Us

Thank you to everyone who has contributed, tested and built on FIPS. This pace of development wouldn’t be possible without your support!

#fips #mesh
Write a comment