NOTICE

Tessera
Copyright 2026 3x3xX3N0N

This product is licensed under the Apache License, Version 2.0 (see LICENSE).

--------------------------------------------------------------------------------
Third-party dependencies
--------------------------------------------------------------------------------

This project depends on the following third-party components. They are not
distributed as part of this source repository; they are resolved at build time.
This listing is informational and is not a substitute for a licence audit.

  Kotlin standard library and Gradle wrapper
      JetBrains / Gradle Inc. — Apache License 2.0

  Bouncy Castle (bcprov-jdk18on)
      The Legion of the Bouncy Castle Inc. — Bouncy Castle Licence (MIT-style)
      Used for: X25519, ML-KEM-768, SHA-256/HKDF, header protection, the
      truncated-tag AEAD open, and as the AEAD fallback. The datapath AEAD is the
      JDK's own ChaCha20-Poly1305, or RustCrypto's through :native when the native
      datapath is on.

  zstd-jni (com.github.luben:zstd-jni)
      Luben Karavelov — BSD 2-Clause; bundles Zstandard (Meta Platforms, Inc.),
      dual-licensed BSD 3-Clause / GPLv2.
      Used for: the optional shared-dictionary payload codec.

  Rust crates used by the :native module
      libc, windows-sys — dual-licensed MIT OR Apache License 2.0.
      chacha20poly1305 (RustCrypto, with its chacha20, poly1305, aead, cipher,
      universal-hash and generic-array crates) — dual-licensed MIT OR Apache
      License 2.0. Used for: the packet AEAD when the native datapath is on
      (tessera_aead_seal / tessera_aead_open, native/rust/src/aead.rs).

--------------------------------------------------------------------------------
Design provenance
--------------------------------------------------------------------------------

Tessera is an independent implementation. It contains no code derived from QUIC
implementations. Several mechanisms are modelled on published IETF specifications
and academic work, implemented from the documents rather than from any codebase:

  RFC 9000 / 9001 / 9002   variable-length integers, truncated packet numbers,
                           connection IDs, ACK ranges, header protection,
                           key update, amplification limits, stateless reset,
                           MAX_DATA-shape connection flow control (§4.1),
                           AEAD confidentiality/integrity limits (RFC 9001 §6.6)
                           as the ceiling the automatic key-rotation policy is
                           measured against
  draft-ietf-quic-         ACK frequency: the shape of an in-connection request
  ack-frequency            to change a peer's acknowledgement cadence (frame
                           0x0A here). Wire encoding, clamps and defaults are
                           Tessera's own; only the mechanism is borrowed.
  RFC 8899                 datagram packetization layer PMTU discovery
  RFC 9438 / RFC 9406      CUBIC and HyStart++ (the loss-based fallback)
  RFC 8439                 ChaCha20-Poly1305. With the native datapath on, the
                           packet AEAD is RustCrypto's chacha20poly1305 called in
                           place through :native (2026-09-02: the JDK provider's
                           per-packet Cipher.init and decrypt-side buffering were
                           the top allocation sites of the bulk profile);
                           otherwise the JDK provider (javax.crypto, SunJCE).
                           BouncyCastle supplies the truncated-tag open, which the
                           JCE Cipher API cannot express, and is the fallback
                           where the provider is absent. All three are RFC 8439
                           and produce identical bytes: JceAeadEquivalenceTest
                           pins native against SunJCE, and both against core's
                           BouncyCastle output, at every length and both tag
                           lengths. No crypto primitive is implemented in this
                           repository.
  FIPS 203                 ML-KEM
  Noise Protocol Framework the one-flight pre-shared-responder-key premise. CORRECTED
                           2026-08-29: earlier revisions of this file said "the IK
                           handshake pattern"; the code (core/Handshake.kt) has no
                           initiator static and no responder ephemeral - it is
                           N-pattern-shaped (e, es) hybridized with ML-KEM, a
                           misstatement found by adversarial review of the threat
                           model and verified against the source. Consequences in
                           docs/THREAT-MODEL.md (no initiator identity, first-flight
                           forward secrecy bounded by both server statics).
  Homa (Ousterhout et al.) receiver-driven credit scheduling
  Adams, Coplien, Gamoke,  "Fault-Tolerant Telecommunication System Patterns"
  Hanmer, Keeve, Nicodemus (PLoP 1995, AT&T Bell Laboratories): design vocabulary,
                           not code. Leaky Bucket Counters and Riding Over
                           Transients are the shape of the gap-repair token bucket
                           and the reordering window; Fool Me Once is the shape of
                           the PTO-backoff ratchet (2026-08-25); and the 2026-09-02
                           reassembly-cap fix (TODO item 12) applies their rule
                           that a count must not take irreversible action on a
                           transient - the cap now derives from the flow window.
                           Each was re-derived here empirically before the paper
                           was read, which is the convergence the working notes
                           say to record.
  kwik (tech.kwik)         benchmark-only dependency of :bench (`bench vs`): an
                           independent, spec-derived Java QUIC implementation
                           used as a measurement baseline. No code or mechanism
                           from it is used in the transport.
  RLNC literature          sliding-window random linear network coding

See docs/SPEC.md for the full list of what was adopted and what was rejected.