ZeroFeed is a zero-dependency CLI utility built in Go 1.25. It pairs NIST FIPS 203 ML-KEM-768 + X25519 hybrid PAKE with ephemeral RAM relays to stream live logs, databases, text, and files between endpoints with zero disk persistence.
git clone https://github.com/zerofeed/zerofeed && cd zerofeed && go build -tags quic -o zerofeed main.go
Designed around three strict software constraints: total composability, zero local state, and minimal binaries.
ZeroFeed functions as a transparent binary filter reading from stdin and writing to stdout. It composes seamlessly with standard tools like tar, pg_dump, docker logs, and grep.
Payloads reside exclusively in volatile memory buffers during transfer. Intermediate relay nodes store zero bytes on disk, maintain zero databases, and preserve zero key material.
Built entirely on Go standard primitives. Compiles into a single static 3.8 MB binary with zero external library dependencies or CGO runtime overhead.
Actual session output transmitting over the public Oracle Cloud Turin relay.
Decrypt and stream live payloads directly in browser memory without installing any local binaries.
Common real-world recipes composing ZeroFeed with standard Unix tools.
Forward live stdout from remote production containers directly into your terminal over E2EE.
docker logs -f app | zerofeed pub -c prod-logs --stream
zerofeed sub -c prod-logs --stream
Stream PostgreSQL dumps directly into a remote target database instance without saving intermediate `.sql` files.
pg_dump db | zerofeed pub -c db-sync --stream
zerofeed sub -c db-sync --stream | psql target_db
Compress and send entire directory trees over E2EE channels and unpack on the fly at destination.
tar -czf - ./data | zerofeed pub -c archive --stream
zerofeed sub -c archive --stream | tar -xzf -
Official RFC-formatted wire envelope diagram and bit offset field layout.
All protocol frames transmitted across TCP stream sockets or QUIC datagram channels MUST strictly adhere to the 33-byte header layout depicted below:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Magic Header ("ZFED") | 4 Bytes
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| MsgType | | 1 Byte (Type)
+-+-+-+-+-+-+-+-+ +
| |
+ Session ID (128 Bits / 16 Bytes) + 16 Bytes (Sess)
| |
+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +
| AEAD Nonce (96 Bits / 12 Bytes) | 12 Bytes (Nonce)
| +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +
| |
+ Encrypted AEAD Payload Data (N Bytes) + N Bytes (Payload)
| |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Octet Offset | Field Identifier | Type / Width | Cryptographic & Framing Protocol Specification |
|---|---|---|---|
00 .. 03 |
Magic Header | [4]byte |
ASCII 0x5A 0x46 0x45 0x44 ("ZFED"). Mandatory preamble for stream validation; dropped immediately if mismatched. |
04 |
MsgType | uint8 |
Unsigned OpCode byte (0x01 PAKE Init, 0x02 PAKE Sub, 0x03 Data Chunk, 0x04 ACK, 0x05 Terminate). |
05 .. 20 |
Session ID | [16]byte |
128-bit cryptographic identifier generated during ML-KEM-768 + X25519 hybrid PAKE. Binds publisher and subscriber pairs. |
21 .. 32 |
AEAD Nonce | [12]byte |
96-bit unique nonce combining a monotonic 64-bit sequence counter with ephemeral salt to eliminate replay attacks. |
33 .. N |
Encrypted Payload | []byte |
32KB binary data slices authenticated with AES-256-GCM AEAD tags and flow-controlled via 512KB sliding window ACKs. |
Designed from day one to align with NIST FIPS 203 and Agenzia per la Cybersicurezza Nazionale (ACN) guidelines.
Fully aligned with ACN recommendations (Section 3.3) for Quantum-Safe Hybrid Key Exchange and 2026 real-time data stream encryption standards.
Employs official NIST ML-KEM-768 (Category 3 Security) via Go standard library for post-quantum key encapsulation.
Implements ETSI TS 103 744 hybrid key derivation (HKDF SHA-256) ready for the European Union 2026-2030 PQC transition roadmap.
256-bit symmetric keys derived per session retain 128 bits of effective security against Grover's quantum search algorithm.
Clear comparison of what ZeroFeed explicitly guarantees versus intentional design non-goals.
crypto.ZeroBytes() and runtime.KeepAlive().Benchmarked performance metrics for Go 1.25 symmetric encryption, PAKE latency, and memory footprint.
| Node / Subsystem | Network & Latency Specs | Security & Processing | Data Integrity & Footprint |
|---|---|---|---|
| Public Relay Node | Global Anycast (Port 8443) | < 1 ms Relay Matchmaking |
Anycast Global Routing |
| QUIC (UDP) WAN Transport | 20 - 35 ms EU Round-Trip Latency | Connection Migration Resilience | Multiplexed Datagram Streams |
| AES-256-GCM AEAD Cipher | 3,844.5 MB/s Symmetric Speed | 1,065 ns/op (1 alloc/op) |
Hardware AES-NI / ARMv8 Crypto |
| Argon2id PAKE Hardening | 64 MB RAM (1 pass) |
~85 ms KDF derivation | GPU brute-force mitigation |
| Static Executable Binary | 3.8 MB Binary Size | 0 CGO dependencies |
Pure Go standard library |
| Prometheus Telemetry | http://<host>:9090/metrics | Zero-Knowledge Lock-Free Atomic Counters |
Prometheus Text Format v0.0.4 |
Command reference table and interactive session commands.
| Command | Description |
|---|---|
zerofeed sub |
Subscribe and decrypt incoming streams from relay. |
zerofeed pub |
Publish encrypted text or file streams to subscriber. |
zerofeed relay |
Launch a standalone zero-knowledge Relay server. |
zerofeed gen |
Generate high-entropy human-readable passphrases. |
| Flag | Description |
|---|---|
--relay, -r |
Relay endpoint (default: 92.4.216.150:8443). |
--channel, -c, --code |
Shared passphrase for PAKE key exchange. |
--quic |
Enable QUIC (UDP) multiplexed transport stream. |
--stream |
Enable continuous stdin/stdout streaming mode. |
--metrics-port |
Export Prometheus telemetry endpoint on specified port (e.g. 9090). |
--fingerprint |
Enforce SPKI SHA-256 TLS certificate fingerprint pinning. |