mutual authentication between relays
relay links use kk against verified roster keys; clients use nk to authenticate the entry. both handshake flights have the same fixed size as transport frames.
client-entry links use the nk pattern; relay-to-relay links use kk against verified roster keys. an authenticated relay refuses an unknown peer or a baseline without authentication, with no fallback. the client stays unauthenticated to the entry.
links now use the noise symmetric transitions. the end-to-end layer keeps its compatible profile in the shared token machine. standard vectors exercise the production transitions with only the cipher and fixed ephemeral inputs substituted. xchacha and gost use custom algorithm combinations; stock noise wire interoperability and a formal proof of those combinations are not claimed.
the first kk flight is replayable and can be forged after disclosure of the responder’s static key. the responder processes no setup and sends no application data until an initiator transport frame confirms the final keys. the header and initiating relay address remain visible.
the limits page describes the remaining boundaries. measurement tables retain their original revision.