KryptaLink

A VPN must move packets between a virtual network interface and an untrusted transport while preserving confidentiality and integrity. KryptaLink makes that path explicit rather than hiding it behind a framework.

The engineering goal is a reviewable implementation that demonstrates packet capture, encrypted UDP transport and separation between networking, cryptographic and orchestration responsibilities.

Trust boundary: plaintext exists only on the private-interface side; transport-facing packets must be authenticated and encrypted.

• TUN/TAP exposes real IP packets and keeps the experiment close to Linux networking primitives.
• UDP avoids inheriting TCP’s stream behavior and makes packet framing, loss and ordering explicit.
• Authenticated-encryption options include AES-GCM and ChaCha20-based construction.
• A modular multithreaded C++ structure separates I/O and cryptographic responsibilities.

• Authenticated encryption is intended to protect confidentiality and detect modification in transit.
• Explicit packet boundaries simplify validation before plaintext reaches the private interface.
• Separation of concerns makes security-sensitive code easier to inspect.

Honest limitation: this is a portfolio implementation, not a claim of production readiness or independent cryptographic audit. Production deployment would require documented key exchange, replay protection, lifecycle management, fuzzing, interoperability tests and third-party review.

Evidence status: Public repository and engineering case study. Production readiness is not claimed.