New Blog Post IETF 127 Hackathon — Call for Participation: OpenNHP
Network-Infrastructure Hiding Protocol (NHP)
Make the Internet
Invisible to Attackers
OpenNHP uses cryptography to hide your attack surface, so attackers can't exploit what they can't see. Authenticate before connection.
Generation 3 — Now
Network-Infrastructure Hiding Protocol (NHP)
Modern cryptography (Noise Protocol, ECC), mutual authentication, and enterprise-grade scalability. Hides domains, IPs, and ports completely.
NHP vs SPA
| Feature | SPA | NHP |
|---|---|---|
| Cryptography | Shared secrets | Modern Cryptography Algorithms (e.g. Noise, IBC, etc) |
| Scalability | Single-point bottleneck | Stateless, infinitely scalable |
| Communication | One-way | Bi-directional with status |
| Hiding Capability | Ports only | Domain, IP, and ports |
| Extensibility | Typically SDP | All-purpose, customizable |
| Library | C/C++ (memory-unsafe) | Memory-safe Go (OpenNHP) |
| Integration | Limited | DNS, FIDO, IAM, Policy Engines |
🔒
Default-Deny Access
All resources are hidden by default. Only authenticated and authorized users can even discover that services exist.
👁️🗨️
Complete Infrastructure Hiding
Hide domains, IP addresses, and ports. Attackers can't attack what they can't find. NXDOMAIN for unauthorized queries.
⚡
High Performance
10K authentication requests per second with sub-100ms latency. Built with Go for memory safety and concurrency.
🔐
Modern Cryptography
Noise Protocol Framework, Curve25519, ChaCha20-Poly1305. Proven secure key exchange to prevent MITM attacks.
🌐
Flexible Deployment
Client-to-Gateway, Client-to-Server, Server-to-Server, Gateway-to-Gateway. Standalone to multi-tenant clusters.
🔗
Seamless Integration
Works with existing IAM, DNS, FIDO, and Zero Trust policy engines. Extends rather than replaces your security stack.
The official NHP protocol implementation in Go. Includes nhp-agent, nhp-server, and nhp-ac components for complete Zero Trust deployments.
Go Linux Windows macOS
View on GitHubA DNS client powered by OpenNHP that implements invisible DNS resolution. Protected domains return NXDOMAIN to unauthorized clients.
DNS Cross-Platform Mobile SDK
View on GitHubIntegrates OpenNHP network hiding with frp reverse proxy — server ports stay invisible until the client is authenticated.
Go Reverse Proxy NAT Traversal
View on GitHubReady to Hide Your Infrastructure?
Join thousands of developers building Zero Trust security with OpenNHP.