YUME glossary
The source map defines the project’s own version and component
vocabulary, and YUME explained shows how the pieces fit
together.
Transport and security
| Term |
Meaning |
| Admission |
The keyed, replay-protected check a tunnel request passes before YUME authentication starts. Failures stay on the cover path. |
| AEAD |
Authenticated encryption with associated data: encryption that also detects tampering. YUME uses AES-256-GCM. |
| ClientHello |
The first TLS message. Its structure can fingerprint a TLS implementation, but does not prove which software sent it. |
| Cover site |
The operator’s static website, served for ordinary HTTP/2 GET and HEAD requests on the public listener. |
| Epoch |
A span of message keys from one root. Rekeying starts the next epoch with fresh key material. |
| Exporter |
A value both ends derive from one TLS connection, used to bind YUME’s keys to that connection. |
| Extended CONNECT |
The HTTP/2 way to open a WebSocket, defined in RFC 8441. |
| GREASE |
Reserved TLS values that clients include so servers keep tolerating unknown extensions. Matching them is part of looking like the captured browser. |
| HKDF |
A key-derivation function that turns shared secrets into keys. YUME uses HKDF-SHA256. |
| HMAC |
A keyed checksum. The admission token is one. |
| ML-KEM, ML-DSA |
NIST’s post-quantum key encapsulation and signature schemes. YUME uses ML-KEM-1024 and ML-DSA-87. |
| Nonce |
A number used once. The admission token and every sealed message use one. |
| PSK |
Pre-shared key: a secret both sides hold before they connect. |
| Ratchet |
Keys that only move forward. Each one is derived, used, and erased. |
| SNI |
The site name a client sends at the start of TLS. Observers can read it. |
| Transport v2 |
The protocol before YTP/1. It has been removed, and commit 9070b0a is the last that contains it. |
| YTP/1 |
YUME Transport Protocol 1, which yume and yumed speak. |
Programs and runtime
| Term |
Meaning |
yume, yumed |
The client and the server daemon. |
| Asio |
The C++ library that runs YUME’s event loop. Code starts an operation and is called back when it completes. |
| Execution context |
The single event loop that runs one endpoint’s network I/O and callbacks in order. |
| SOCKS5 |
A small local proxy protocol that many applications already support. |
| Stream |
One application connection inside a tunnel, identified by its stream number. |
| TUN |
A virtual network interface through which a device’s packets can be routed. |