Zajil¶

An owned, accountable, end-to-end encrypted communication network — a bridge from the ancient courier world to the modern encrypted one. Not built for anonymity. Built to be ours: every identity issued in person, every server disposable, every layer understood.

A zajil is a carrier pigeon — the fast courier of the pre-modern world. The servers are named Barid, after the postal-and-intelligence relay network of the early Islamic caliphates: staffed stations along a route, each passing the message on. The names are the thesis. This is old infrastructure rebuilt with modern cryptography.

What Zajil is¶

A self-hosted communication network for a closed institution — the working scale is a university, ~10,000 devices. Peers talk end-to-end encrypted. Servers relay ciphertext they cannot read. Every device on the network belongs to a human whose identity was verified in person.

Three commitments shape every decision that follows:

Owned, not rented

The only trust anchor is a root key held offline, on our own devices. No certificate authority, no DNS registrar, no cloud provider sits in the trust path. Infrastructure can be burned and rebuilt without touching a single client.
Accountable, not anonymous

This is deliberately not a privacy-maximising network. Enrollment is physical. Every identity maps to a verified person. Abuse is handled by attribution and revocation — a halal alternative to the anonymity tools of the privacy world, where the network cannot be used for what it should not be.
Understood, not shipped

A decade-scale mastery project. There is no application to ship. The deliverable is complete command of every layer — cryptography, derivation, protocol design — at SQLite-class quality. Code that arrives faster than understanding is a regression.

The shape of the system¶

The anchor

One offline root key. Signs a versioned manifest and short-lived server certificates. Loss of a server costs nothing; loss of the root key is the only unrecoverable event, and is defended accordingly.

Trust model
The endpoints

A cell is one machine. It binds dozens of ephemeral IPv6 addresses, each derived from a secret and the clock — never announced, never in DNS. Learn one and you gain nothing; authentication happens elsewhere.

Address derivation
The clock

Addresses rotate on a schedule both sides compute independently, borrowing TOTP's counter without its human-facing baggage. This is the first module under construction.

Time buckets
The door

Enrollment happens at a desk, against an ID. Credentials deplete slowly and are refreshed in person, so the network self-provisions and self-cleans. No remote enrollment exists, by design.

Enrollment

Status¶

design phase Module 2.1 (time buckets) is under construction, test-first.

Nothing is shipped and nothing is rushed. The architecture on these pages is the record of decisions made so far, written to be reviewed and argued with before more code is written.

How to read this site

Concepts and Architecture describe the design. Operations covers running and defending it. Engineering is how the code gets built and why it is being built this way. Decisions holds the terse, canonical record (ADR); the narrative pages explain it in depth. Open Questions is what is still unsettled.