opennhp README

The project's README from github.com/OpenNHP/opennhp. As one markdown file: README.md.

en zh-cn zh-tw de ja fr es id

OpenNHP Logo

OpenNHP: Open Source Zero Trust Security Toolkit

Build Release License codecov Ask DeepWiki

OpenNHP is a lightweight, cryptography-powered, open-source toolkit implementing Zero Trust security for infrastructure, applications, and data. It is the reference implementation of the Cloud Security Alliance (CSA) Network-infrastructure Hiding Protocol (NHP) specification, and features two core protocols:

Website · Vision · Live Demo · Documentation · Discord

Why OpenNHP

The modern internet is a dark forest. Attackers — increasingly backed by LLMs that scan, fingerprint, and exploit at machine speed via Autonomous Vulnerability Exploitation — treat every reachable service as a target. Gartner projects AI-driven cyberattacks will rise rapidly. Traditional defenses authenticate users after the network lets them in, leaving exposed ports, IPs, and domains as a permanent attack surface.

In the AI era, VISIBILITY = VULNERABILITY.

OpenNHP inverts that model: invisible until trusted. Every port, IP, and hostname sits behind a default-deny gate. Access is granted only after a cryptographically signed knock is authenticated and authorized out-of-band. Attackers can't exploit what they can't discover.

The third-generation network hiding protocol

NHP is the next step in a line of "hide the service first" designs:

Generation Protocol Limitations
1 Port Knocking Plaintext, replay-prone
2 Single Packet Authorization (SPA) Shared secrets, one-way, typically hides ports only, typically C/C++
3 NHP Modern crypto, bi-directional with status, hides domain + IP + ports, stateless and horizontally scalable, memory-safe Go

NHP slots in alongside existing IAM, DNS, FIDO, and Zero Trust policy engines rather than replacing them — it extends your stack instead of forking it.

Architecture

OpenNHP follows a modular design with three core components, inspired by the NIST Zero Trust Architecture:

OpenNHP architecture

Core Component Role
NHP-Agent Client that sends encrypted knock requests to gain access
NHP-Server Authenticates and authorizes requests; runs separately and is architecturally decoupled from the protected host
NHP-AC Access controller that manages firewall rules on the protected server
Addon Component Role
NHP-Relay HTTP-to-UDP bridge enabling browser-based agents to send NHP knocks via HTTPS
NHP-KGC Key Generation Center for Identity-Based Cryptography (IBC)

Protocol flow

  1. Agent sends an encrypted knock (NHP_KNK) to the Server.
  2. Server validates the knock and sends an operation request (NHP_AOP) to the AC.
  3. AC opens the firewall and replies (NHP_ART) to the Server.
  4. Server returns an acknowledgment (NHP_ACK) with access info to the Agent.
  5. Agent reaches the protected resource through the AC.

Cryptography

OpenNHP ships with two interchangeable cipher suites:

Both are driven by the Noise Protocol Framework. An Identity-Based Cryptography (IBC) mode is available via the Key Generation Center (KGC).

For protocol details, deployment models, and cryptographic design, see the documentation.

Repository Structure

opennhp/
├── nhp/              # Core protocol library (Go module)
│   ├── core/         # Packet handling, cryptography, Noise Protocol, device management
│   ├── common/       # Shared types and message definitions
│   ├── utils/        # Utility functions
│   ├── plugins/      # Plugin handler interfaces
│   ├── log/          # Logging infrastructure
│   └── etcd/         # Distributed configuration support
└── endpoints/        # Daemon implementations (Go module, depends on nhp)
    ├── agent/        # NHP-Agent daemon
    ├── server/       # NHP-Server daemon
    ├── ac/           # NHP-AC (access controller) daemon
    ├── db/           # NHP-DB (Data Broker for DHP)
    ├── kgc/          # NHP-KGC (Key Generation Center)
    └── relay/        # NHP-Relay daemon

Quick Start

Prerequisites

Build

# Build all components
make

# Build individual daemons
make agentd    # NHP-Agent
make serverd   # NHP-Server
make acd       # NHP-AC
make db        # NHP-DB
make relayd    # NHP-Relay
make kgc       # NHP-KGC

Test

cd nhp && go test ./...
cd endpoints && go test ./...

Run with Docker

cd docker && docker-compose up --build

Follow the Quick Start tutorial to simulate the full authentication workflow in a Docker environment.

Contributing

We welcome contributions! Please read CONTRIBUTING.md before submitting pull requests.

Note: All commits must be signed with a verified GPG or SSH key.

git commit -S -m "your message"

Security

Found a vulnerability? Please follow the responsible-disclosure process in SECURITY.md rather than opening a public issue.

Sponsors

LayerV.ai logo    Atlas Cloud logo    Tencent Cloud logo

License

Released under the Apache 2.0 License.

Contact

opennhp (OpenNHP/opennhp)

Searching Database…

13.9K ·GitHub
Opennhp
What is this?OpenNHP is a lightweight, cryptography-powered, open-source Zero Trust toolkit: it hides server ports, IP addresses, and domain names so your infrastructure stays invisible until a client is cryptographically authorized.
Is this a single program, or several components I deploy together?It's a kit of cooperating components, not one app: NHP-Agent (the client), NHP-Server (authenticates knocks, runs decoupled from the protected host), and NHP-AC (manages firewall rules on the protected server).
How do I get it running?You need Go 1.26+ and make to build, plus Docker and Docker Compose for the demo. The Quick Start tutorial simulates the full authentication workflow in a Docker environment.
Do clients need special software to connect — will my regular browser work?Clients must speak the NHP knock protocol; a plain browser can't send the UDP knock directly. For browser-based agents there's NHP-Relay, an HTTP-to-UDP bridge that sends knocks over HTTPS.
Where does this actually run?It deploys on your own servers (typically Linux) as Go-built components, with the Quick Start running the whole stack in Docker Compose.
Does it do anything about protecting the data itself, not just the network?Yes — that's the second protocol: DHP uses encryption and confidential computing so data stays 'usable but not visible' even while it's processed.
What is the difference between NHP and DHP?NHP works at the network layer: ports, IP addresses, and domain names stay hidden until an authorized knock opens them. DHP works at the data layer: encryption and confidential computing keep data 'usable but not visible' even where it's processed.
How is NHP different from older port-knocking approaches?It's positioned as the third generation. Port knocking sent plaintext sequences and was replay-prone; Single Packet Authorization added crypto but used shared secrets, was one-way, and typically hid only ports. NHP brings modern Noise-framework crypto, bi-directional status, hides domains along with IPs and ports, and is stateless so it scales horizontally — all in memory-safe Go.
Why hide servers at all when AI-driven scanners exist?Because in the authors' words, in the AI era visibility equals vulnerability: LLM-backed attackers fingerprint and exploit exposed services at machine speed. OpenNHP's answer is default-deny — attackers can't exploit what they can't discover.
What is NHP-KGC for?It's the Key Generation Center for Identity-Based Cryptography — an optional mode where keys tie to identities and are issued by the KGC, instead of pre-distributing certificates between every agent and server.
What are similar projects?flowsint, pangolin, cloudflared, scuttle, trufflehog, nebula, netbird, gun
Which topics is it in?zero-trust, cryptography, infrastructure, authentication, cybersecurity, encryption, security-tools, docker-compose, networking, go, privacy, security
Creator
OpenNHP
Size
100.8 MB
Stars
13.9K
Updated
CommitOct 14Releasev1.0.2Sep 11
Age
12y
Commits · 90 Days