Celatim

Celatim is a typed Python 3.14+ package for authenticated file transfer and reproducible research on covert channels and steganographic carriers in IETF protocol fields. It accompanies a survey and measurement study of the fields protocols mark reserved, “must be zero,” ignored on receipt, opaque, or optional, and publishes the channel and defensive implementations together so the measurements can be reproduced and both communication and normalization behavior evaluated.

What It Provides

• Channel codecs and PDU implementations for carrier fields across the protocol stack
• Controlled endpoint transports for cross-host execution on real Linux network stacks
• Capacity models separating header-relative width from on-wire density
• Detector and scrub guidance generators for the defensive reading of each channel
• Scenario execution and evidence artifacts for reproducible, tiered measurement
• An offer-based transfer CLI and async SDK for authenticated file transfer

Companion Study

The library is the executable artifact for a keyword-guided screen of every RFC from 1 to 9937 (9,738 issued documents), which catalogs 181 candidate carrier fields across 74 protocols, 176 of them usable in practice. Every usable channel is implemented and measured for byte-for-byte recovery, throughput, and efficiency between Linux hosts, alongside production-daemon paths and a benign-cohort detector evaluation.

Dual-Use Posture

The work is deliberately dual-use: the same field a defender wants to detect can enable censorship-resistant communication for people under surveillance. The channel implementations, catalog, measurements, and detection/scrub guidance are released together under Apache-2.0. The relevant standards and techniques are already available to well-resourced actors, while withholding working code would disproportionately exclude independent researchers, defenders, and people who need censorship-resistant communication.

Use Celatim only in controlled environments and on systems and networks you are authorized to test.

Installation

python -m pip install 'celatim[transfer]'

Requires CPython 3.14 or newer; Linux for AF_PACKET, network-namespace, tcpdump, and QEMU/TAP workflows.