Why YUME exists

YUME exists to help people reach the internet freely through servers they control. Its transport carries TCP, UDP and IP packets over one authenticated, browser-shaped connection. You can run it as a client and server or embed the same engine in another program.

Yume (夢) means dream in Japanese. The dream behind it is internet freedom for everyone. Anime openings helped inspire the name.

When goals conflict, YUME picks security first, then stealth, then speed. It still has to be fast enough for everyday use, including HD video.

Its protocol, YTP/1, and its implementation are written for this project. Other transports are useful for comparison, but they do not set YUME’s design or feature list.

What a client gets

A client reaches the server through SOCKS5, a managed Linux TUN device, or the C ABI for named byte streams, packets and routed TCP/UDP. Each uses the same native transport. The server checks each client’s identity and destination policy before opening a destination. Operators grant services and set per-client limits as described in operations.

Security contract

YTP/1 has one fixed cryptographic composition. Each peer authenticates its composite identity with Ed25519 and ML-DSA-87 signatures. Session keys combine X25519, ML-KEM-1024, a per-identity pre-shared key and the TLS 1.3 exporter. The handshake transcript binds the suite, roles, identities, capabilities and security parameters. Records use one-use AES-256-GCM keys from directional ratchets. A missing component or provider mismatch fails the connection. There is no fallback suite and no weaker mode. The threat model states the assumptions behind it.

Cover website

yumed serves ordinary HTTP/2 requests from a configured static website. A valid, replay-protected admission proof opens a carrier for YTP/1 authentication. The browser-shaped TLS and HTTP/2 geometry is a separately versioned profile, so recapturing a newer browser does not change YTP/1.

The profile comes from real browser captures, and tests compare YUME’s ClientHello and HTTP/2 opening with them. Stealth describes the captures and what they measured.

Pinned dependencies

Source dependencies are pinned and listed in a deterministic SPDX 2.3 SBOM, docs/release/SBOM.spdx.json:

SOURCE_DATE_EPOCH=0 python3 scripts/check_dependency_sbom.py --check

A release must also publish binary hashes, the toolchain, the linked-library inventory and a signed manifest.