Lightway - ExpressVPN’s proprietary VPN protocol

What is Lightway?

Lightway is ExpressVPN’s proprietary VPN protocol, designed to be fast, secure, lightweight, and reliable. It replaces traditional protocols like OpenVPN and WireGuard with a custom-built solution optimized for modern devices.

Why is Lightway important?

  • Offers faster connection times and better battery efficiency.

  • Built using Rust, enhancing security and performance.

  • Open-source and auditable, increasing trust and transparency.

How Lightway works (in simple steps):

  • You connect to ExpressVPN using the Lightway protocol.

  • Lightway establishes a secure encrypted tunnel using wolfSSL.

  • Your internet traffic is routed through this tunnel to the VPN server.

  • The server forwards your traffic to its destination, masking your IP and encrypting your data.

Where is Lightway used?

  • ExpressVPN apps on Android, iOS, Windows, macOS, Linux, and routers.

  • Ideal for mobile users, travelers, and privacy-conscious individuals who need fast and stable VPN connections.

Which OSI Layer does this protocol belong to?

Lightway operates at the Application Layer (Layer 7) because: * It interacts directly with user-level applications to establish secure communication. * It wraps and secures lower-layer protocols, providing encrypted transport for app data.

Topics in this section,

  • In this section, you are going to learn

  • Terminology

  • Version Info

Lightway Version

RFC

Year

Core Idea / Contribution

Lightway v1

Internal Spec (C-based)

2020

Initial release of Lightway protocol, written in C. Focused on speed, reliability, and lownbattery usage 1.

Lightway v1.1

Internal Spec

2021

Open-sourced on GitHub; added support for multiple platforms and improved handshake performance 2.

Lightway v2

Internal Spec (Rust)

2023

Rewritten in Rust for memory safety, better performance, and resistance to memory exploits 1.

Lightway v2.1

Internal Spec

2024

Introduced post-quantum encryption support and enhanced session management.

Lightway v2.2

Internal Spec

2025

Optimized for mobile and IoT devices; improved keepalive and reconnection logic.

Setup

Setup

Handshake Packet

S.No

Protocol Packets

Description

Size(Bytes)

1

Handshake Packet

Initiates a secure session between client and server using wolfSSL.

~100-200

Version

Protocol version identifier.

1

Random

Random value for key exchange.

32

Session ID

Identifies the session uniquely.

32

Cipher Suite

Specifies encryption algorithms (e.g., ChaCha20, AES-GCM).

2-4

Key Exchange Data

Ephemeral keys for secure key agreement.

32-64

Signature

Verifies authenticity of the handshake.

64-128

Extensions

Optional fields for future use or enhancements.

Variable

Data Packet

S.No

Protocol Packets

Description

Size(Bytes)

2

Data Packet

Encrypted payload carrying user data

~60-1500

Packet Header

Includes session ID, sequence number, and flags

8-16

Encrypted Payload

Actual user data encrypted with negotiated cipher

Variable

MAC (Message Auth Code)

Ensures integrity and authenticity of the packet

16-32

Keepalive Packet

S.No

Protocol Packets

Description

Size(Bytes)

3

Keepalive Packet

Maintains session during idle periods

~20-40

Type

Indicates keepalive or ping

1

Timestamp

Used to measure latency and detect timeouts

8

Padding

Optional, for obfuscation or alignment

Variable

Session Termination

S.No

Protocol Packets

Description

Size(Bytes)

4

Session Termination

Gracefully closes the session

~20-40

Reason Code

Indicates why the session is ending

1

Session ID

Identifies the session being terminated

32

S.no

Use Case

Description

1

Secure Internet Access

Encrypts all internet traffic between user and VPN server, ensuring privacy and anonymity.

2

Fast VPN Connections

Provides near-instant connection and reconnection, ideal for mobile and unstable networks.

3

Streaming & Gaming

Optimized for low latency and high throughput, making it suitable for streaming and online games.

4

Public Wi-Fi Protection

Secures data on untrusted networks (e.g., airports, cafes) by encrypting all traffic.

5

Cross-Platform VPN

Works across Android, iOS, Windows, macOS, Linux, and routers with consistent performance.

6

Battery-Efficient VPN

Designed to consume minimal power, especially on mobile devices.

7

IoT & Embedded Devices

Lightweight design makes it suitable for resource-constrained environments like IoT.

8

Bypass Censorship

Helps users access restricted content in regions with internet censorship or surveillance.

S.no

Feature

Description

1

Lightweight Design

Built from the ground up to be minimal and efficient, reducing overhead and improving speed.

2

Fast Connection & Reconnect

Establishes VPN tunnels almost instantly and reconnects quickly after network interruptions.

3

Modern Cryptography

Uses wolfSSL with ChaCha20, AES-GCM, and modern key exchange (e.g., X25519) for strong security.

4

Cross-Platform Support

Works seamlessly across Android, iOS, Windows, macOS, Linux, and routers.

5

Battery Efficiency

Optimized for mobile devices to reduce power consumption during active and idle states.

6

Session Persistence

Maintains session state across network changes (e.g., switching from Wi-Fi to mobile data).

7

Minimal Attack Surface

Smaller codebase and fewer dependencies reduce the risk of vulnerabilities.

8

Open Source Transparency

Source code is publicly available for audit and community review.

9

Rust Implementation (v2+)

Rewritten in Rust for memory safety and performance improvements.

10

Future-Ready Architecture

Designed to support future enhancements like post-quantum cryptography and IoT integration.

Lightweight Design - Testcases

#

Test Case

Description

Expected Result

1

Protocol Initialization

Start Lightway protocol session

Session initialized successfully

2

Minimal Handshake

Perform handshake with minimal steps

Handshake completes quickly

3

Low CPU Usage

Monitor CPU usage during session

CPU usage remains low

4

Low Memory Usage

Monitor memory usage during session

Memory usage remains low

5

Fast Connection Setup

Establish VPN connection

Connection established in under 1 second

6

Fast Reconnection

Reconnect after network drop

Reconnection is seamless

7

Small Binary Size

Check protocol binary size

Binary size is under 100KB

8

Minimal Dependencies

Verify external dependencies

No external dependencies required

9

Mobile Optimization

Run on mobile device

Runs efficiently on mobile

10

Battery Efficiency

Measure battery usage

Low battery consumption

11

Embedded Device Support

Run on embedded system

Protocol runs successfully

12

Cross-Platform Support

Run on multiple OS

Protocol runs on all platforms

13

Quick Resume

Resume session after sleep

Session resumes instantly

14

Minimal Codebase

Review codebase size

Codebase is compact

15

Fast TLS-Free Handshake

Establish session without TLS

Session established securely

16

Lightweight Encryption

Use ChaCha20-Poly1305

Encryption applied successfully

17

Efficient Key Exchange

Use Curve25519

Key exchange completes quickly

18

Minimal Packet Overhead

Inspect packet headers

Overhead is minimal

19

Fast DNS Resolution

Resolve DNS through tunnel

DNS resolved quickly

20

Quick IP Assignment

Assign IP to client

IP assigned instantly

21

Fast Tunnel Setup

Create encrypted tunnel

Tunnel created in milliseconds

22

Minimal Latency

Measure latency

Latency under 10ms

23

Lightweight Logging

Enable logging

Logs generated with minimal impact

24

Quick Disconnect

Terminate session

Session ends instantly

25

Minimal Config File

Review config file size

Config file is under 1KB

26

Fast Failover

Switch to backup server

Failover completes quickly

27

Quick Server Switch

Switch VPN server

Switch completes in seconds

28

Minimal Reconnect Delay

Reconnect after timeout

Delay under 1 second

29

Fast Certificate Validation

Validate certs

Validation completes quickly

30

Efficient Session Resumption

Resume previous session

Session resumed without full handshake

31

Quick NAT Traversal

Connect behind NAT

Traversal completes instantly

32

Fast Firewall Bypass

Connect through firewall

Connection successful

33

Quick Protocol Negotiation

Negotiate protocol version

Negotiation completes quickly

34

Minimal Thread Usage

Monitor thread count

Few threads used

35

Fast API Response

Call Lightway API

Response in milliseconds

36

Quick Metrics Collection

Collect performance metrics

Metrics collected instantly

37

Fast Alert Trigger

Trigger alert on failure

Alert triggered immediately

38

Quick Log Rotation

Rotate logs

Rotation completes instantly

39

Minimal Disk I/O

Monitor disk usage

Disk I/O is minimal

40

Fast Config Reload

Reload config file

Reload completes instantly

41

Quick Role Assignment

Assign user role

Role assigned instantly

42

Fast Group Mapping

Map user to group

Mapping completes quickly

43

Quick Access Control

Apply access rules

Rules enforced instantly

44

Fast Certificate Revocation

Revoke certificate

Revocation applied instantly

45

Quick OCSP Validation

Validate cert via OCSP

Validation completes quickly

46

Fast CRL Check

Check CRL for cert

CRL check completes quickly

47

Quick Performance Test

Run performance test

Test completes in seconds

48

Fast Stress Test

Simulate high load

Protocol handles load efficiently

49

Quick Debug Mode

Enable debug mode

Debug info available instantly

50

Documentation Review

Check lightweight design docs

All features documented

Fast Connection & Reconnect - Testcases

#

Test Case

Description

Expected Result

1

Fast Initial Connection

Establish VPN connection

Connection established in under 1 second

2

Reconnect After Drop

Simulate network drop

VPN reconnects instantly

3

Reconnect on Wi-Fi Switch

Switch between Wi-Fi networks

VPN reconnects without user action

4

Reconnect on Mobile Data Switch

Switch from Wi-Fi to mobile data

VPN reconnects seamlessly

5

Reconnect on Airplane Mode Toggle

Toggle airplane mode

VPN reconnects automatically

6

Resume After Sleep

Resume device from sleep

VPN reconnects immediately

7

Resume After Hibernate

Resume from hibernation

VPN reconnects without delay

8

Reconnect on App Restart

Restart VPN app

VPN reconnects automatically

9

Reconnect on OS Restart

Reboot device

VPN reconnects on boot

10

Reconnect on SIM Change

Swap SIM card

VPN reconnects with new network

11

Reconnect on Carrier Switch

Switch mobile carrier

VPN reconnects with new IP

12

Reconnect on IP Change

Change IP dynamically

VPN reconnects without drop

13

Reconnect on Server Switch

Switch VPN server

VPN reconnects to new server

14

Reconnect on Protocol Switch

Switch between UDP and TCP

VPN reconnects using new protocol

15

Reconnect on Port Change

Change VPN port

VPN reconnects on new port

16

Reconnect on NAT Change

Change NAT environment

VPN reconnects seamlessly

17

Reconnect on Firewall Rule Change

Modify firewall rules

VPN reconnects if needed

18

Reconnect on DNS Change

Change DNS settings

VPN reconnects and uses new DNS

19

Reconnect on Proxy Change

Change proxy configuration

VPN reconnects with new proxy

20

Reconnect on VPN Crash

Force crash VPN process

VPN restarts and reconnects

21

Reconnect on App Crash

Crash VPN app

VPN reconnects after restart

22

Reconnect on Session Timeout

Let session expire

VPN reconnects automatically

23

Reconnect on Token Expiry

Expire auth token

VPN re-authenticates and reconnects

24

Reconnect on Certificate Renewal

Renew VPN certificate

VPN reconnects with new cert

25

Reconnect on Config Change

Modify VPN config

VPN reconnects with updated settings

26

Reconnect on Policy Update

Update VPN policy

VPN reconnects with new policy

27

Reconnect on Load Balancer Switch

Switch load balancer endpoint

VPN reconnects to new endpoint

28

Reconnect on Failover

Simulate server failover

VPN reconnects to backup server

29

Reconnect on Backgrounding

Send app to background

VPN remains connected or reconnects

30

Reconnect on Foregrounding

Bring app to foreground

VPN reconnects if needed

31

Reconnect on Lock/Unlock

Lock and unlock device

VPN reconnects after unlock

32

Reconnect on Network Congestion

Simulate high network load

VPN reconnects if dropped

33

Reconnect on Throttling

Throttle VPN traffic

VPN reconnects or adapts

34

Reconnect on Debug Mode

Enable debug mode

VPN reconnects and logs details

35

Reconnect on Metrics Collection

Collect metrics

VPN reconnects if interrupted

36

Reconnect on Alert Trigger

Trigger alert condition

VPN reconnects after alert

37

Reconnect on Log Rotation

Rotate logs

VPN remains connected

38

Reconnect on App Update

Update VPN app

VPN reconnects after update

39

Reconnect on OS Update

Update operating system

VPN reconnects after reboot

40

Reconnect on Role Change

Change user role

VPN reconnects with new permissions

41

Reconnect on Group Mapping Change

Update group mapping

VPN reconnects with new group

42

Reconnect on Access Control Change

Modify access rules

VPN reconnects with updated access

43

Reconnect on CRL Update

Update certificate revocation list

VPN reconnects with new CRL

44

Reconnect on OCSP Response

Validate cert via OCSP

VPN reconnects after validation

45

Reconnect on App Optimization

Enable app sleep optimization

VPN reconnects after sleep

46

Reconnect on Kill Switch Trigger

Trigger kill switch

VPN reconnects when safe

47

Reconnect on Interface Reset

Reset network adapter

VPN reconnects after reset

48

Reconnect on API Call

Trigger reconnect via API

VPN reconnects programmatically

49

Reconnect on CLI Command

Trigger reconnect via CLI

VPN reconnects via command

50

Reconnect on Documentation Review

Review reconnect feature docs

All reconnect scenarios documented

Modern Cryptography - Testcases

#

Test Case

Description

Expected Result

1

Enable ChaCha20-Poly1305

Use ChaCha20-Poly1305 cipher in Lightway

Cipher enabled successfully

2

Disable Legacy Ciphers

Ensure Lightway does not support legacy ciphers

Legacy ciphers rejected

3

Handshake with ChaCha20

Perform handshake using ChaCha20

Handshake completes securely

4

Encrypt Traffic with ChaCha20

Encrypt tunnel traffic with ChaCha20

Traffic encrypted

5

Key Exchange with Curve25519

Use Curve25519 for key exchange

Keys exchanged securely

6

Key Rotation

Rotate keys during session

Keys rotated without session drop

7

Forward Secrecy

Verify forward secrecy in session

Forward secrecy ensured

8

AEAD Mode Enforcement

Use AEAD cipher mode

AEAD encryption applied

9

Replay Attack Prevention

Replay encrypted packets

Packets rejected

10

Packet Tampering Detection

Modify encrypted packet

Packet rejected

11

Session Resumption

Resume session securely

Session resumed with new keys

12

TLS-Free Design

Verify no TLS dependency

Lightway operates without TLS

13

Lightweight Cipher Suite

Confirm minimal cipher suite

Only modern ciphers supported

14

Encrypt IPv6 Traffic

Send IPv6 traffic through Lightway tunnel

Traffic encrypted

15

Encrypt IPv4 Traffic

Send IPv4 traffic through Lightway tunnel

Traffic encrypted

16

Encrypt DNS Requests

Send DNS queries through tunnel

DNS encrypted

17

Encrypt UDP Traffic

Send UDP traffic through tunnel

Traffic encrypted

18

Encrypt TCP Traffic

Send TCP traffic through tunnel

Traffic encrypted

19

Encrypt ICMP Traffic

Send ICMP traffic through tunnel

Traffic encrypted

20

Encrypt Fragmented Packets

Send fragmented packets

Packets encrypted and reassembled

21

Encrypt Large Payload

Send large data payload

Payload encrypted

22

Encrypt Small Payload

Send small data payload

Payload encrypted

23

Encrypt Compressed Data

Send compressed data

Data encrypted after compression

24

Encrypt Multicast Traffic

Send multicast traffic

Traffic encrypted

25

Encrypt Broadcast Traffic

Send broadcast traffic

Traffic encrypted

26

Use X25519 for Key Exchange

Use X25519 in Lightway

Key exchange successful

27

Use Ed25519 for Authentication

Authenticate with Ed25519

Authentication successful

28

Use SHA256 for Integrity

Use SHA256 for HMAC

Integrity verified

29

Use SHA512 for Integrity

Use SHA512 for HMAC

Integrity verified

30

Use HMAC for Authentication

Apply HMAC to encrypted packets

HMAC verified

31

Use Pre-Shared Key

Authenticate with PSK

Connection established

32

Use Custom Cipher Plugin

Load custom cipher module

Custom cipher applied

33

Cipher Negotiation Logging

Log cipher negotiation

Cipher suite logged

34

Cipher Negotiation Failure

Use unsupported cipher

Connection rejected

35

Cipher Suite Priority

Set cipher preference

Highest priority cipher used

36

Cipher Suite Order

Change cipher order

Order respected

37

Minimal Handshake Time

Measure handshake duration

Handshake completes quickly

38

Session Timeout

Let session idle

Session times out as configured

39

Session Termination

Terminate session manually

Session ends cleanly

40

Session Reuse

Reuse session parameters

Session reused securely

41

Encrypt with GCM (fallback)

Attempt GCM fallback (if supported)

GCM applied or rejected

42

Encrypt with AES-256-GCM

Use AES-256-GCM (if supported)

AES-256-GCM encryption applied

43

Encrypt with AES-128-GCM

Use AES-128-GCM (if supported)

AES-128-GCM encryption applied

44

Encrypt with Camellia (test)

Attempt Camellia cipher

Connection rejected

45

Encrypt with Null Cipher

Attempt null cipher

Connection rejected

46

Encrypt with CBC Mode

Attempt CBC mode

Not supported / rejected

47

Encrypt with Custom Curve

Use custom elliptic curve

Curve accepted or rejected

48

Encrypt with Weak Hash

Use SHA1 for HMAC

Connection rejected

49

Encrypt with Deprecated Cipher

Use Blowfish or 3DES

Connection rejected

50

Documentation Review

Check Lightway crypto documentation

All features documented

Cross-Platform Support - Testcases

#

Test Case

Description

Expected Result

1

Windows Client Connection

Connect using Lightway on Windows OS

Connection established successfully

2

macOS Client Connection

Connect using Lightway on macOS

Connection established successfully

3

Linux Client Connection

Connect using Lightway on Linux

Connection established successfully

4

Android Client Connection

Connect using Lightway on Android

Connection established successfully

5

iOS Client Connection

Connect using Lightway on iOS

Connection established successfully

6

Windows Reconnect

Reconnect after drop on Windows

Reconnection successful

7

macOS Reconnect

Reconnect after drop on macOS

Reconnection successful

8

Linux Reconnect

Reconnect after drop on Linux

Reconnection successful

9

Android Reconnect

Reconnect after drop on Android

Reconnection successful

10

iOS Reconnect

Reconnect after drop on iOS

Reconnection successful

11

Windows Sleep Resume

Resume VPN after sleep on Windows

VPN reconnects automatically

12

macOS Sleep Resume

Resume VPN after sleep on macOS

VPN reconnects automatically

13

Linux Sleep Resume

Resume VPN after sleep on Linux

VPN reconnects automatically

14

Android Sleep Resume

Resume VPN after sleep on Android

VPN reconnects automatically

15

iOS Sleep Resume

Resume VPN after sleep on iOS

VPN reconnects automatically

16

Windows App Update

Update VPN app on Windows

VPN reconnects after update

17

macOS App Update

Update VPN app on macOS

VPN reconnects after update

18

Linux App Update

Update VPN app on Linux

VPN reconnects after update

19

Android App Update

Update VPN app on Android

VPN reconnects after update

20

iOS App Update

Update VPN app on iOS

VPN reconnects after update

21

Windows Network Switch

Switch networks on Windows

VPN reconnects automatically

22

macOS Network Switch

Switch networks on macOS

VPN reconnects automatically

23

Linux Network Switch

Switch networks on Linux

VPN reconnects automatically

24

Android Network Switch

Switch networks on Android

VPN reconnects automatically

25

iOS Network Switch

Switch networks on iOS

VPN reconnects automatically

26

Windows IPv6 Support

Use IPv6 on Windows

IPv6 traffic encrypted

27

macOS IPv6 Support

Use IPv6 on macOS

IPv6 traffic encrypted

28

Linux IPv6 Support

Use IPv6 on Linux

IPv6 traffic encrypted

29

Android IPv6 Support

Use IPv6 on Android

IPv6 traffic encrypted

30

iOS IPv6 Support

Use IPv6 on iOS

IPv6 traffic encrypted

31

Windows DNS Leak Test

Check DNS leak on Windows

No DNS leak detected

32

macOS DNS Leak Test

Check DNS leak on macOS

No DNS leak detected

33

Linux DNS Leak Test

Check DNS leak on Linux

No DNS leak detected

34

Android DNS Leak Test

Check DNS leak on Android

No DNS leak detected

35

iOS DNS Leak Test

Check DNS leak on iOS

No DNS leak detected

36

Windows Kill Switch

Trigger kill switch on Windows

Internet blocked until reconnect

37

macOS Kill Switch

Trigger kill switch on macOS

Internet blocked until reconnect

38

Linux Kill Switch

Trigger kill switch on Linux

Internet blocked until reconnect

39

Android Kill Switch

Trigger kill switch on Android

Internet blocked until reconnect

40

iOS Kill Switch

Trigger kill switch on iOS

Internet blocked until reconnect

41

Windows Battery Usage

Measure battery usage on Windows

Low battery consumption

42

macOS Battery Usage

Measure battery usage on macOS

Low battery consumption

43

Linux Battery Usage

Measure battery usage on Linux

Low battery consumption

44

Android Battery Usage

Measure battery usage on Android

Low battery consumption

45

iOS Battery Usage

Measure battery usage on iOS

Low battery consumption

46

Windows App Permissions

Check permissions on Windows

Permissions granted

47

macOS App Permissions

Check permissions on macOS

Permissions granted

48

Linux App Permissions

Check permissions on Linux

Permissions granted

49

Android App Permissions

Check permissions on Android

Permissions granted

50

iOS App Permissions

Check permissions on iOS

Permissions granted

Battery Efficiency - Testcases

#

Test Case

Description

Expected Result

1

Idle Battery Drain

Measure battery usage while VPN is idle

Minimal battery drain observed

2

Active Data Transfer

Measure battery usage during heavy data transfer

Battery usage remains low

3

Background Operation

Run VPN in background

Battery consumption is efficient

4

Foreground Operation

Run VPN in foreground

Battery usage is optimized

5

Sleep Mode Resume

Resume from sleep with VPN active

No significant battery impact

6

Roaming Between Networks

Switch between Wi-Fi and mobile data

Battery usage remains stable

7

App Backgrounding

Send VPN app to background

Battery usage remains low

8

App Foregrounding

Bring VPN app to foreground

No battery spike observed

9

Low Signal Strength

Operate VPN under weak signal

Battery usage remains efficient

10

High Signal Strength

Operate VPN under strong signal

Battery usage is minimal

11

Mobile Data Usage

Use VPN over mobile data

Battery usage is optimized

12

Wi-Fi Usage

Use VPN over Wi-Fi

Battery usage is minimal

13

Battery Saver Mode

Enable battery saver mode

VPN adapts to conserve battery

14

App Sleep Optimization

Enable OS-level app sleep optimization

VPN maintains efficiency

15

VPN Reconnect

Reconnect VPN after drop

No battery spike during reconnect

16

VPN Auto-Start

Enable VPN auto-start on boot

Battery usage remains low

17

VPN Auto-Reconnect

Enable auto-reconnect feature

Battery usage is efficient

18

VPN Idle Timeout

Enable idle timeout

Battery saved during inactivity

19

VPN Keepalive

Enable keepalive packets

Battery usage remains low

20

VPN Ping Interval

Adjust ping interval

Battery usage optimized

21

VPN Compression

Enable compression

Battery usage remains efficient

22

VPN Encryption

Use ChaCha20 encryption

Battery usage is optimized

23

VPN Logging

Enable verbose logging

Battery usage slightly increased

24

VPN Minimal Logging

Enable minimal logging

Battery usage is minimal

25

VPN Metrics Collection

Collect performance metrics

Battery usage remains efficient

26

VPN Alerts Enabled

Enable alert notifications

Battery usage remains low

27

VPN Alerts Disabled

Disable alert notifications

Battery usage is minimal

28

VPN GUI Mode

Use GUI client

Battery usage remains efficient

29

VPN CLI Mode

Use CLI client

Battery usage is minimal

30

VPN API Mode

Use API to control VPN

Battery usage remains low

31

VPN Debug Mode

Enable debug mode

Battery usage slightly increased

32

VPN Normal Mode

Run in normal mode

Battery usage is optimized

33

VPN with Split Tunneling

Enable split tunneling

Battery usage is reduced

34

VPN Full Tunnel

Route all traffic through VPN

Battery usage remains efficient

35

VPN with IPv6

Use IPv6 traffic

Battery usage remains low

36

VPN with IPv4

Use IPv4 traffic

Battery usage remains low

37

VPN with Dual Stack

Use both IPv4 and IPv6

Battery usage remains efficient

38

VPN with NAT

Operate behind NAT

Battery usage remains low

39

VPN with Firewall

Operate with firewall enabled

Battery usage remains efficient

40

VPN with Proxy

Use VPN with proxy

Battery usage remains low

41

VPN with Load Balancer

Use VPN with load balancer

Battery usage remains efficient

42

VPN with Failover

Trigger failover

Battery usage remains stable

43

VPN with Metrics Export

Export metrics periodically

Battery usage remains efficient

44

VPN with Cert Rotation

Rotate certificates

Battery usage remains low

45

VPN with OCSP

Use OCSP for cert validation

Battery usage remains efficient

46

VPN with CRL

Use CRL for cert validation

Battery usage remains efficient

47

VPN with Role Mapping

Apply role-based access

Battery usage remains low

48

VPN with Group Mapping

Apply group-based access

Battery usage remains low

49

VPN with Access Control

Apply access control rules

Battery usage remains efficient

50

Documentation Review

Review battery efficiency documentation

All features documented

Session Persistence - Testcases

#

Test Case

Description

Expected Result

1

Session Resume After Sleep

Resume session after device sleep

Session resumes without re-authentication

2

Session Resume After Hibernate

Resume session after hibernation

Session resumes successfully

3

Session Resume After Lock

Lock and unlock device

Session remains active

4

Session Resume After App Restart

Restart VPN app

Session resumes automatically

5

Session Resume After OS Restart

Reboot device

Session resumes if configured

6

Session Resume After Network Drop

Drop and restore network

Session resumes without full handshake

7

Session Resume After IP Change

Change IP address dynamically

Session resumes seamlessly

8

Session Resume After Carrier Switch

Switch mobile carrier

Session resumes without drop

9

Session Resume After Roaming

Roam between networks

Session persists

10

Session Resume After Timeout

Resume session after idle timeout

Session resumes if within grace period

11

Session Resume After App Crash

Crash and restart VPN app

Session resumes automatically

12

Session Resume After OS Crash

Simulate OS crash and reboot

Session resumes if persisted

13

Session Resume After Failover

Trigger server failover

Session resumes with backup server

14

Session Resume After Load Balancer Switch

Switch load balancer endpoint

Session resumes without drop

15

Session Resume After Config Change

Change VPN config

Session resumes with new config

16

Session Resume After Certificate Rotation

Rotate certificates

Session resumes securely

17

Session Resume After Token Refresh

Refresh auth token

Session resumes without disconnect

18

Session Resume After Role Change

Change user role

Session resumes with updated permissions

19

Session Resume After Group Mapping

Update group mapping

Session resumes with new group access

20

Session Resume After Access Control Update

Modify access rules

Session resumes with new rules

21

Session Resume After NAT Change

Change NAT environment

Session resumes without issue

22

Session Resume After Firewall Rule Change

Modify firewall rules

Session resumes if allowed

23

Session Resume After Proxy Change

Change proxy settings

Session resumes with new proxy

24

Session Resume After DNS Change

Change DNS configuration

Session resumes with new DNS

25

Session Resume After Port Change

Change VPN port

Session resumes on new port

26

Session Resume After Protocol Switch

Switch between UDP and TCP

Session resumes using new protocol

27

Session Resume After Encryption Update

Update encryption settings

Session resumes securely

28

Session Resume After Compression Toggle

Enable/disable compression

Session resumes with updated settings

29

Session Resume After Logging Toggle

Enable/disable logging

Session resumes without disruption

30

Session Resume After Metrics Toggle

Enable/disable metrics collection

Session resumes with updated settings

31

Session Resume After Alert Trigger

Trigger alert condition

Session remains active

32

Session Resume After Debug Mode Toggle

Enable/disable debug mode

Session resumes with logging

33

Session Resume After GUI Restart

Restart GUI client

Session resumes automatically

34

Session Resume After CLI Restart

Restart CLI client

Session resumes automatically

35

Session Resume After API Call

Resume session via API

Session resumes successfully

36

Session Resume After App Update

Update VPN app

Session resumes after update

37

Session Resume After OS Update

Update operating system

Session resumes after reboot

38

Session Resume After Battery Saver Toggle

Enable/disable battery saver

Session resumes without drop

39

Session Resume After Sleep Optimization

Enable OS sleep optimization

Session resumes efficiently

40

Session Resume After Kill Switch Trigger

Trigger and reset kill switch

Session resumes when safe

41

Session Resume After Log Rotation

Rotate logs

Session remains active

42

Session Resume After Metrics Export

Export session metrics

Session remains active

43

Session Resume After OCSP Check

Perform OCSP validation

Session resumes securely

44

Session Resume After CRL Check

Perform CRL validation

Session resumes securely

45

Session Resume After IPv6 Switch

Switch to IPv6

Session resumes without drop

46

Session Resume After IPv4 Switch

Switch to IPv4

Session resumes without drop

47

Session Resume on Dual Stack

Use both IPv4 and IPv6

Session persists across both

48

Session Resume After Split Tunnel Toggle

Enable/disable split tunneling

Session resumes with new routing

49

Session Resume After Full Tunnel Toggle

Enable/disable full tunneling

Session resumes with new routing

50

Documentation Review

Review session persistence documentation

All features documented

Minimal Attack Surface - Testcases

#

Test Case

Description

Expected Result

1

Minimal Codebase Review

Review Lightway codebase

Codebase is compact and auditable

2

No TLS Dependency

Verify absence of TLS stack

TLS not required

3

Limited Protocol Exposure

Check exposed ports and services

Only essential ports exposed

4

Minimal Packet Metadata

Inspect packet headers

Minimal metadata present

5

No Legacy Cipher Support

Attempt to use deprecated ciphers

Connection rejected

6

No TLS Downgrade Path

Attempt TLS downgrade

Downgrade blocked

7

No Compression by Default

Check if compression is disabled

Compression disabled

8

Minimal Logging Enabled

Enable minimal logging

Logs contain no sensitive data

9

No Dynamic Module Loading

Attempt to load external modules

Modules not accepted

10

No Plugin Interface

Check for plugin support

No plugin interface available

11

Minimal Config Surface

Review config file options

Only essential options available

12

No Web Interface

Check for web-based admin interface

None available

13

No JavaScript Execution

Check for JS execution in client

No JS executed

14

No File Upload Feature

Attempt file upload via VPN

Feature not supported

15

No HTTP Exposure

Scan for HTTP services

No HTTP services exposed

16

Minimal Binary Size

Check binary size

Binary is small

17

No Shell Access

Attempt shell access via VPN

Access denied

18

No Built-in Web Server

Check for embedded web server

None present

19

No External Dependencies

Review linked libraries

Only core libraries used

20

Minimal API Surface

Review API endpoints

Only essential APIs exposed

21

No GUI Admin Panel

Check for admin GUI

Not available

22

No Remote Code Execution

Attempt RCE via config or traffic

RCE blocked

23

No Scripting Support

Attempt to run scripts via VPN

Not supported

24

Minimal Authentication Vectors

Review auth mechanisms

Only secure methods supported

25

No Password Storage

Check for password storage

Passwords not stored

26

No Session Hijacking

Attempt session hijack

Session protected

27

No Cookie Usage

Check for cookie usage

No cookies used

28

No Java Dependencies

Check for Java runtime

Not required

29

No XML Parsing

Attempt XML injection

XML not parsed

30

No SQL Interface

Attempt SQL injection

No SQL interface present

31

No File System Access

Attempt to access file system

Access denied

32

No Environment Variable Exposure

Check for env var leaks

None exposed

33

No Debug Interface in Production

Check for debug endpoints

Not available

34

No Hardcoded Secrets

Scan for hardcoded credentials

None found

35

No Broadcast Services

Check for broadcast traffic

None sent

36

No Multicast Services

Check for multicast traffic

None sent

37

No UPnP Support

Attempt UPnP discovery

Not supported

38

No mDNS Support

Attempt mDNS resolution

Not supported

39

No SMB Exposure

Scan for SMB services

None exposed

40

No Telnet Exposure

Scan for Telnet services

None exposed

41

No FTP Exposure

Scan for FTP services

None exposed

42

No SNMP Exposure

Scan for SNMP services

None exposed

43

No ICMP Reflection

Attempt ICMP reflection attack

Blocked

44

No Port Forwarding

Attempt to forward ports

Not supported

45

No NAT-PMP Support

Attempt NAT-PMP discovery

Not supported

46

No IGMP Support

Attempt IGMP join

Not supported

47

No WebSocket Exposure

Scan for WebSocket endpoints

None exposed

48

No DNS Rebinding Vulnerability

Attempt DNS rebinding

Blocked

49

No Cross-Protocol Exploits

Attempt cross-protocol attack

Blocked

50

Documentation Review

Review minimal attack surface documentation

All features documented

Open Source Transparency - Testcases

#

Test Case

Description

Expected Result

1

Source Code Availability

Check if Lightway source code is public

Source code is publicly accessible

2

License Verification

Verify open source license type

License is OSI-approved (e.g., GPL)

3

Code Repository Access

Access official code repository

Repository is accessible without auth

4

Commit History Review

Review commit history

Commits are transparent and traceable

5

Contributor List

View list of contributors

Contributors are publicly listed

6

Issue Tracker Access

Access issue tracker

Public can view and report issues

7

Pull Request Transparency

Review pull requests

PRs are public and reviewable

8

Code Review Process

Check for code review logs

Reviews are documented and visible

9

Build Instructions Available

Check for build documentation

Instructions are clear and complete

10

Reproducible Builds

Attempt to reproduce build from source

Build matches official binaries

11

Cryptographic Audit Logs

Review cryptographic implementation logs

Logs are public and verifiable

12

Security Audit Reports

Access third-party audit reports

Reports are publicly available

13

Vulnerability Disclosure Policy

Check for disclosure policy

Policy is documented and accessible

14

CVE Tracking

Check for CVEs assigned to Lightway

CVEs are listed and tracked

15

Code Signing Verification

Verify signed releases

Signatures match published keys

16

Public Key Availability

Access public signing keys

Keys are published and verifiable

17

Documentation Transparency

Review protocol documentation

Docs are complete and open

18

Protocol Specification Access

Access Lightway protocol spec

Specification is publicly available

19

Change Log Review

Review changelog for releases

Changes are clearly documented

20

Version Tagging

Check for version tags in repo

Tags are consistent and traceable

21

Community Forum Access

Access community discussions

Forums are open and active

22

Developer Mailing List

Join or view dev mailing list

Archives are public

23

Public Roadmap

View development roadmap

Roadmap is published

24

Governance Model Transparency

Review project governance model

Model is documented

25

Open Contribution Guidelines

Check contribution process

Guidelines are public and inclusive

26

Code Quality Tools

Check for use of linters/tests

Tools are integrated and visible

27

CI/CD Pipeline Visibility

Review CI/CD pipeline

Pipeline is public and reproducible

28

Test Coverage Reports

Access test coverage reports

Reports are available

29

Static Analysis Reports

Review static analysis results

Reports are published

30

Dependency Transparency

List third-party dependencies

Dependencies are documented

31

License Compliance Tools

Check for license scanning tools

Tools are used and results shared

32

Open Bug Reports

View open bugs

Bugs are publicly tracked

33

Closed Bug Reports

View closed bugs

Resolutions are documented

34

Security Patch History

Review past security patches

History is complete and public

35

Public Test Suites

Access test cases and suites

Tests are open and reproducible

36

Open Benchmark Results

Review performance benchmarks

Results are published

37

Open Source Dependencies

Verify all dependencies are open source

All dependencies are OSI-compliant

38

Source Code Mirrors

Check for code mirrors (e.g., GitHub, GitLab)

Mirrors are up-to-date

39

Public API Documentation

Access API documentation

Docs are complete and public

40

Open Source Client Libraries

Verify client libraries are open source

Libraries are publicly maintained

41

Open Source Server Components

Verify server components are open source

Components are publicly maintained

42

Open Source Mobile SDKs

Verify mobile SDKs are open source

SDKs are available and documented

43

Open Source Desktop Clients

Verify desktop clients are open source

Clients are available and documented

44

Open Source Licensing Audit

Review license audit reports

Reports are available

45

Open Source Compliance Badge

Check for compliance badges

Badges are displayed

46

Open Source Community Recognition

Check for community awards or recognition

Project is recognized

47

Open Source Events Participation

Check for participation in OSS events

Project is active in community

48

Open Source Funding Transparency

Review funding sources

Funding is disclosed

49

Open Source Sponsorships

Check for sponsors

Sponsors are listed

50

Documentation Review

Review open source transparency documentation

All features documented

Rust Implementation (v2+) - Testcases

#

Test Case

Description

Expected Result

1

Rust Initialization

Initialize Lightway protocol using Rust v2+

Initialization successful

2

Rust Compilation

Compile Rust source code

Compilation succeeds without errors

3

Rust Binary Size

Check binary size

Binary is compact and optimized

4

Rust Performance Benchmark

Run performance tests

Performance meets expectations

5

Rust Memory Usage

Monitor memory usage

Memory usage remains low

6

Rust CPU Usage

Monitor CPU usage

CPU usage remains efficient

7

Rust Error Handling

Trigger runtime error

Error handled gracefully

8

Rust Panic Recovery

Simulate panic

System recovers without crash

9

Rust Logging

Enable logging

Logs generated correctly

10

Rust TLS-Free Handshake

Perform handshake without TLS

Handshake completes securely

11

Rust Encryption

Encrypt traffic using ChaCha20

Traffic encrypted successfully

12

Rust Key Exchange

Use Curve25519 for key exchange

Keys exchanged securely

13

Rust Session Resume

Resume session after drop

Session resumes without full handshake

14

Rust Reconnect

Reconnect after network drop

Reconnection is fast and seamless

15

Rust IPv6 Support

Use IPv6

IPv6 traffic encrypted

16

Rust IPv4 Support

Use IPv4

IPv4 traffic encrypted

17

Rust Dual Stack

Use both IPv4 and IPv6

Dual stack supported

18

Rust NAT Traversal

Connect behind NAT

Connection established

19

Rust Firewall Traversal

Connect through firewall

Connection successful

20

Rust Mobile Optimization

Run on mobile device

Efficient performance observed

21

Rust Battery Efficiency

Measure battery usage

Low battery consumption

22

Rust Background Operation

Run in background

Session remains active

23

Rust Foreground Operation

Run in foreground

Session remains active

24

Rust Sleep Resume

Resume after sleep

Session resumes automatically

25

Rust App Restart

Restart VPN app

Session resumes successfully

26

Rust OS Restart

Reboot device

Session resumes if persisted

27

Rust Failover

Trigger server failover

Session resumes with backup server

28

Rust Load Balancer

Switch load balancer endpoint

Session resumes without drop

29

Rust Config Reload

Reload config file

Settings applied successfully

30

Rust Certificate Rotation

Rotate certificates

Session resumes securely

31

Rust Token Refresh

Refresh auth token

Session resumes without disconnect

32

Rust Role Mapping

Apply role-based access

Access granted correctly

33

Rust Group Mapping

Apply group-based access

Access granted correctly

34

Rust Access Control

Apply access rules

Access enforced correctly

35

Rust CRL Check

Perform CRL validation

Revoked certs rejected

36

Rust OCSP Check

Perform OCSP validation

Cert validated successfully

37

Rust Metrics Collection

Collect performance metrics

Metrics recorded

38

Rust Alert Trigger

Trigger alert condition

Alert generated

39

Rust Log Rotation

Rotate logs

Logs rotated successfully

40

Rust Debug Mode

Enable debug mode

Debug info available

41

Rust API Control

Control VPN via API

API responds correctly

42

Rust CLI Control

Control VPN via CLI

CLI executes commands

43

Rust GUI Control

Control VPN via GUI

GUI reflects changes

44

Rust Split Tunneling

Enable split tunneling

Traffic routed correctly

45

Rust Full Tunnel

Enable full tunnel mode

All traffic encrypted

46

Rust Protocol Switch

Switch between UDP and TCP

Switch successful

47

Rust Port Change

Change VPN port

Connection resumes on new port

48

Rust DNS Leak Test

Check for DNS leaks

No leaks detected

49

Rust IP Leak Test

Check for IP exposure

Real IP hidden

50

Rust Kill Switch

Trigger kill switch

Internet blocked until reconnect

Future-Ready Architecture - Testcases

#

Test Case

Description

Expected Result

1

Modular Design Verification

Inspect protocol architecture

Modules are decoupled and reusable

2

Protocol Extensibility

Add new feature module

Feature integrates without core changes

3

Multi-Platform Compilation

Compile for multiple OS targets

Compilation succeeds on all platforms

4

Mobile Platform Support

Run on Android and iOS

Protocol runs efficiently

5

Embedded System Support

Run on embedded Linux

Protocol runs with minimal resources

6

Cloud-Native Compatibility

Deploy in containerized environment

Protocol runs in Docker/Kubernetes

7

WASM Compatibility

Compile to WebAssembly

Protocol compiles and runs in browser

8

IoT Device Integration

Run on IoT device

Protocol operates within constraints

9

API-First Design

Access via public API

API is stable and documented

10

CLI Interface Support

Control via command line

CLI responds correctly

11

GUI Interface Support

Control via GUI

GUI reflects protocol state

12

Headless Operation

Run without UI

Protocol functions in headless mode

13

Stateless Session Handling

Resume session without persistent state

Session resumes securely

14

Stateless Server Support

Run server in stateless mode

Server handles connections independently

15

Multi-Threading Support

Run with multiple threads

Threads managed efficiently

16

Async Runtime Compatibility

Run with async runtimes (e.g., Tokio)

Protocol integrates with async runtimes

17

Rust Crate Modularity

Use as a Rust crate

Crate compiles and integrates cleanly

18

Language Binding Support

Bind to other languages (e.g., Python, Go)

Bindings compile and function correctly

19

Plugin Architecture

Add plugin module

Plugin loads and runs securely

20

Configurable Build Flags

Compile with feature flags

Flags toggle features as expected

21

Protocol Versioning

Support multiple protocol versions

Version negotiation succeeds

22

Backward Compatibility

Connect with older clients

Connection succeeds

23

Forward Compatibility

Connect with newer clients

Connection succeeds

24

Hot Reload Support

Reload config without restart

Config reloads without downtime

25

Dynamic Port Binding

Bind to dynamic ports

Port binding succeeds

26

IPv6-Only Network Support

Operate in IPv6-only environments

Protocol functions normally

27

Dual Stack Network Support

Operate in dual stack networks

IPv4 and IPv6 both supported

28

Quantum-Resistant Cipher Ready

Integrate post-quantum cipher

Cipher negotiates successfully

29

Post-Quantum Key Exchange

Use PQ key exchange (e.g., Kyber)

Keys exchanged securely

30

Lightweight Cryptography Ready

Integrate lightweight cipher (e.g., Ascon)

Cipher applied successfully

31

Zero Trust Architecture Support

Integrate with ZTA frameworks

Protocol enforces identity-based access

32

Identity Federation Integration

Integrate with SSO/IdP

Auth succeeds via federation

33

Multi-Factor Authentication Ready

Add MFA layer

MFA enforced successfully

34

Secure Boot Compatibility

Run on secure boot systems

Protocol verified and runs

35

TPM Integration

Use Trusted Platform Module

Keys stored and accessed securely

36

Secure Enclave Support

Run inside secure enclave (e.g., SGX)

Protocol runs in isolated environment

37

Hardware Acceleration Ready

Use crypto acceleration (e.g., AES-NI)

Performance improves with hardware

38

ARM Architecture Support

Compile and run on ARM CPUs

Protocol runs efficiently

39

RISC-V Architecture Support

Compile and run on RISC-V

Protocol runs successfully

40

Cross-Compilation Support

Cross-compile for multiple targets

Builds succeed for all targets

41

CI/CD Integration

Integrate with CI/CD pipelines

Builds and tests run automatically

42

DevSecOps Ready

Integrate with security scanning tools

Scans pass with no critical issues

43

Observability Integration

Export metrics/logs to observability tools

Metrics visible in dashboards

44

OpenTelemetry Support

Export traces via OpenTelemetry

Traces collected successfully

45

Distributed Deployment Ready

Deploy across distributed systems

Protocol scales horizontally

46

Multi-Region Deployment Support

Operate across regions

Sessions persist across regions

47

Edge Computing Ready

Run on edge nodes

Protocol performs efficiently

48

Serverless Compatibility

Run in serverless environments

Protocol initializes quickly

49

Documentation Availability

Review architecture documentation

Docs are complete and up-to-date

50

Community Feedback Integration

Review community-driven improvements

Feedback reflected in roadmap

  • Reference links