Git repository
A mirror of the repository is available on github.
A library that implements the Sanctum protocol can be found here.
Releases
Stable releases are distributed as source tarballs and can be found below. Only this website distributes release tarballs for sanctum, do not download release tarballs from other sites.
1.1.2
sanctum-1.1.2.tgz (3.1MB)
released: 2026-05-29
sha256: d4b730626f317ddd8b74019e62b7720a7360228e332bf498124e161c46eedfbf
Highlights
- Small mbedtls-aes-gcm fixes.
- Adjust shroud mask to cover sanctum_proto_hdr.
1.1.1
sanctum-1.1.1.tgz (3.1MB)
released: 2026-05-19
sha256: f35d1721a7301df0491114c5548d0b2175d93fa877cbb93210e7324041e46d7d
Highlights
- More paranoia when procs exit, explicitly call nyfe_zeroize_all() and warn on linger sensitive assets.
- Hold back key exchanges for a minute if a peer does not answer, reduces packets on the wire a bit when the peer is not online.
- Fixed a missing sanctum_packet_release() in an error path in confess.
- Cathedrals can now signal to peers if they are behind the same external ip, paving the way for local discovery later.
- Cathedrals now only forget tunnels are 120 seconds, instead of 45.
- Cathedrals now only allow offers to be federated each 3 seconds, instead of 1.
1.1.0
sanctum-1.1.0.tgz (3.1MB)
released: 2026-04-15
sha256: 17ccba4f8d495f65beff5bfdfd8ebaaaba75ec0283874d8b17fc3ada9fd8b3e6
Highlights
- New shroud functionality, replacing encapsulation. A shroud will mask away protocol meta-data with unique per-client traffic protection keys making traffic analysis much harder.
Packages
Packages exist for the following distributions: