KMX: a modern mesh protocol built for operators
Kimox Mesh eXchange (KMX) combines Noise-based handshakes, identity-bound keys, and coordinated relay fallback — WireGuard-grade cryptography with the control plane your platform team actually wants.
How KMX works
- 01
Enroll with identity, not shared secrets
Each node generates a long-lived keypair locally and registers its public key with the Kimox control plane under a human or machine identity. Bootstrap tokens are single-use and expire in minutes — there is no org-wide pre-shared key to leak.
- 02
Negotiate paths over KMX control messages
Before any payload flows, peers exchange capability advertisements: supported ciphers, preferred paths, and tag memberships. The control plane coordinates NAT discovery and selects direct UDP, hole-punched, or relayed routes automatically.
- 03
Establish encrypted sessions with Noise IK
KMX uses a Noise IK handshake profile with ChaCha20-Poly1305 and Curve25519. Sessions rotate keys on a fixed interval and bind to the identity that initiated enrollment — swapping IPs does not grant access.
- 04
Enforce policy at the edge of every tunnel
ACL evaluation happens on the initiating node before packets enter the wire. Denied flows never leave the device. Policy updates propagate through the control plane and invalidate stale sessions without restarting agents.
Technical highlights
Minimal attack surface
Roughly 4,000 lines of audited Go in the data plane. No legacy protocol baggage, no optional weak ciphers, no downgrade paths.
Identity-bound key rotation
Node keys rotate on schedule and on compromise signal. Revoking an identity invalidates all associated keys cluster-wide within seconds.
Relay coordination
Region-local relay nodes terminate only when direct paths fail. Traffic stays encrypted end-to-end; relays never decrypt payload frames.
Embedded name resolution
MagicDNS records ship alongside peer advertisements. Split-horizon resolution keeps internal names off public resolvers.
Verifiable audit trail
Every handshake, relay selection, and policy denial emits a signed event. Export to your SIEM without custom syslog parsers.
Horizontally scalable control plane
Stateless coordination APIs and regional relay pools handle tens of thousands of concurrent peers without a single chokepoint appliance.
Ready to simplify your network?
Start free with up to 3 users. Scale when your team does.
Get started free