Project Fabric is a secure protocol for delivering authenticated public information — weather, market prices, health notices, official documents, and life-safety alerts — over everyday human movement. It needs no towers, no data plans, and no accounts, and every phone cryptographically verifies what it receives before showing it.
In regions where networks are shut down, priced out, or were never built, people still need to know tomorrow's weather, today's crop prices, and whether the river ford is passable. What fills the gap is word of mouth — unverifiable, stale, and easy to poison.
Cell towers can be switched off. Internet access can be filtered, surveilled, or made unaffordable. A resilient channel can't depend on either existing.
A three-day-old flood warning is worse than none. Information needs a verifiable clock and an expiry date — even on phones that have never seen accurate time.
Anyone can retype a "government announcement" and pass it along. Readers need proof of who published a story and when — checkable on the phone itself, offline.
Most systems fight to keep infrastructure alive. Project Fabric assumes the opposite: the towers are down, the internet is filtered, and no server can be trusted. It then uses the one network that never fails — people moving. A single signed file is published once and spreads person to person; cryptography, not a server, guarantees it is real. The result is a communications substrate that works precisely when ordinary connectivity does not.
An edition rides SD cards, phone-to-phone shares, and brief Bluetooth encounters on the bus or in the market queue. Devices exchange only the pieces each is missing, and interrupted transfers are banked — never restarted. Delivery emerges from daily life, no schedule required.
Every phone verifies a publisher's digital signature offline against keys it already holds. There is no authority online to attack, bribe, or switch off — and a forged "government notice" is rejected on the device before it is ever shown.
No accounts, no addresses, no location, no history. The reader app cannot even request internet permission, and the build fails if a dependency tries to add it. Being caught carrying the app reveals nothing about who you talk to — because it never knew.
An edition is published once, then spreads phone-to-phone through ordinary daily life — the bus, the market, the clinic queue. Every hop verifies. No hop needs the internet.
Articles go into a deterministic console: the same inputs always produce byte-identical output, so any reviewer can independently reproduce what was published. No cloud, no server farm — one plain machine.
Signing keys live on a machine that has never touched a network. Only a few hundred bytes of metadata cross the gap — content physically cannot reach the keys, and the signer refuses anything content-shaped.
The signed edition is packed into a single file with erasure-coded pieces and cryptographic proofs for every fragment. Any file transport works: an SD card, a USB stick, a phone-to-phone share.
Village anchor phones seed the edition. Buses, traders, and market visits do the rest — phones exchange pieces during brief encounters, and partial transfers are banked, never wasted. Three hops from the newsroom, a farmer has today's forecast.
Signatures are checked on-device, against keys the phone already holds. Forged or tampered content is rejected before it costs a single byte of storage — or a single unit of battery-hungry cryptography.
Editions carry an expiry. When it passes, the content is gone — from every phone, automatically. Storage stays tiny, stale warnings can't circulate, and a signed clock keeps even offline phones honest about what "expired" means.
Project Fabric began as a question: how can authenticated public information be disseminated securely over intermittently-connected networks while preserving deniability and resisting abuse in adversarial environments? Existing tools each answer part of it — secure messaging, mesh transport, delay-tolerant routing — but none answer all of it together. The project's three contributions do.
Authenticated public information over intermittent connectivity: publisher-signed, transport-independent, verified on every device, with monotonic time, expiry, replay resistance, and abuse limited by construction. Backed by two byte-exact implementations that agree on golden vectors and two machine-checked invariants.
Guarantees are enforced when the software is compiled, by threat model — not toggled at runtime. An adversarial (Profile A) build cannot compile addressing, identity, reply, or self-locating code, and a signed capability manifest lets anyone prove what a binary can and cannot do. This is the project's most novel single idea.
Efficient dissemination without continuous infrastructure, using observed mobility and publisher trust rather than trained models: high- mobility carriers are preferred, higher-trust content is scheduled first, and only missing pieces move. It matches brute-force flooding's reach at a fraction of the traffic (see results).
The important properties aren't promises in a document — they're enforced by construction, and the two most critical are proved with machine-checked formal models.
A phone subscribed only to public news can never be made to store — or even cryptographically process — content from any other channel. Possession of sensitive material requires opting in; it cannot happen to you.
Time on the fabric only moves forward, driven by signed anchors. Expired content stays expired; an adversary replaying old bundles can't bring back yesterday's prices or a cancelled alert.
Hostile input is bounced by cheap structural checks before any signature verification runs. A flood of forged alerts costs the attacker effort — and the phone nothing.
No accounts, no logs, no history. One tap clears a phone to a forensically empty state. The reader app requests no internet permission at all — and the build fails if a dependency tries to sneak it in.
Run against the classic delay-tolerant protocols on an identical, seed-pinned contact trace, Fabric matches the delivery of brute-force flooding while sending a tiny fraction of the messages — and it out-reaches the selective protocols outright. Less traffic means less battery, less congestion, and longer-lasting phones.
| Routing strategy | Delivery | Network traffic (messages) | Efficiency (delivered / message) |
|---|---|---|---|
| Fabric | 100% | 39 | 1.03 — best |
| Epidemic flooding | 100% | 2,942 | 0.01 |
| PRoPHET-style | 55% | 21 | 1.05 |
| Spray & Wait | 20% | 7 | 1.14 |
* Methodology demonstrator on synthetic contact traces (identical contact stream per strategy, seed-pinned, reproducible from the repository — nf-ref/nf_ref/dtn_sim.py). Fabric delivers to every node using ≈75× fewer transmissions than flooding. Validation on real-world traces is a scheduled milestone.
Two independent implementations agree byte-for-byte on golden test vectors — including the exact rejection step and cryptographic cost of every malicious input.
The operator console runs the full pipeline — compose, air-gapped sign, seal — and previews exactly what readers will see, verification and all.
Open the operator console →