# How iroh Differs from Other P2P Networking Projects: 8 Key Architectural Differences > Explore how iroh's Rust-first QUIC framework innovates P2P networking. Discover 8 key architectural differences, from public key addressing to built-in hole punching, setting it apart from other projects. - Repository: [number zero/iroh](https://github.com/n0-computer/iroh) - Tags: architecture - Published: 2026-07-03 --- **iroh is a Rust-first, QUIC-based peer-to-peer framework that uses public keys as network addresses, eliminating the need for separate peer ID layers while providing built-in hole punching, encrypted relay fallback, and a pluggable transport architecture.** Unlike traditional peer-to-peer stacks that rely on separate identity abstraction layers and heavy certificate infrastructure, iroh takes a fundamentally different approach to connectivity. As implemented in the n0-computer/iroh repository, this framework treats Ed25519 public keys as first-class network endpoints, enabling direct authentication without the complexity found in libp2p, WebRTC, or generic VPN solutions. ## Public-Key Dialing Without Peer ID Abstraction Every iroh node is identified by a single **Ed25519 public key** that doubles as both identity and authentication material. In [`iroh/src/lib.rs`](https://github.com/n0-computer/iroh/blob/main/iroh/src/lib.rs), the `EndpointId` type represents this cryptographic identity, allowing you to dial peers directly using their public key without mapping tables or address resolution services. The connection establishment in `Endpoint::connect(endpoint_id, …)` uses this key as the canonical address. This eliminates the indirection layers common in other P2P frameworks where you must resolve peer IDs to network addresses through distributed hash tables or rendezvous services. ## Built-in Hole Punching and Encrypted Relay Fallback iroh implements **automatic hole punching** using STUN-like exchanges to establish direct QUIC connections between NATed peers. When direct paths fail, the system falls back to relay servers that function as encrypted, stateless forwarders. The relay client logic lives in [`iroh/src/socket/transports/relay.rs`](https://github.com/n0-computer/iroh/blob/main/iroh/src/socket/transports/relay.rs), while the server implementation in [`iroh-relay/src/server/http_server.rs`](https://github.com/n0-computer/iroh/blob/main/iroh-relay/src/server/http_server.rs) handles encrypted forwarding without ever accessing plaintext payloads. This integration contrasts with other ecosystems where hole punching requires manual configuration or external STUN/TURN servers. ## Lightweight QUIC via noq Instead of OpenSSL or native TLS stacks, iroh relies on the **noq** crate to create authenticated QUIC connections. This enables peer-to-peer TLS where each side authenticates the other's public key directly, without the traditional client/server certificate model. The integration point is visible in [`iroh/src/endpoint/quic.rs`](https://github.com/n0-computer/iroh/blob/main/iroh/src/endpoint/quic.rs), which wires the noq library into the endpoint lifecycle. This approach reduces binary size while maintaining cryptographic security suitable for embedded and mobile environments. ## Pluggable Transport Architecture iroh defines a **transport ID table** in [`TRANSPORTS.md`](https://github.com/n0-computer/iroh/blob/main/TRANSPORTS.md) that allows developers to plug in custom address types such as Tor or BLE. This extensibility differs from libp2p's multiaddr format, where transport selection is baked into the addressing scheme. The registry lists supported and experimental transports, enabling uniform handling of diverse network layers without modifying core connection logic. ## DNS-Based Address Resolution (Pkarr) Rather than maintaining a separate DHT, iroh resolves `EndpointId` values to `RelayUrl` and direct addresses via **DNS TXT records** using the Pkarr protocol. This lookup mechanism, implemented in [`iroh/src/address_lookup/dns.rs`](https://github.com/n0-computer/iroh/blob/main/iroh/src/address_lookup/dns.rs), eliminates the need for persistent rendezvous services. The companion DNS server in [`iroh-dns-server/src/main.rs`](https://github.com/n0-computer/iroh/blob/main/iroh-dns-server/src/main.rs) publishes endpoint records, allowing clients to discover paths through standard DNS infrastructure while maintaining cryptographic trust boundaries. ## Modular Protocol Composition Above the QUIC layer, iroh offers **iroh-blobs**, **iroh-gossip**, and **iroh-docs** as separate, reusable crates. This "protocol-as-crate" model, documented in the README, contrasts with monolithic stacks that bundle all functionality into a single runtime. Developers import only the protocols they need, reducing attack surface and binary size while maintaining interoperability between components. ## Minimal Runtime Footprint By leveraging noq and avoiding heavyweight crypto providers, iroh binaries remain under 2 MiB. This makes the framework suitable for resource-constrained environments where other P2P implementations would exceed memory or storage budgets. ## Authentication-First Design Philosophy iroh optimizes for **authenticated P2P applications** such as secure file sync and private messaging, where public key identity is a feature rather than a liability. This differs from anonymity-focused networks like Tor or I2P, which introduce latency and complexity to obfuscate endpoints. The public-key-first approach provides cryptographic accountability while maintaining low-latency, direct end-to-end encryption between known peers. ## Practical Implementation Examples ### Connecting to a Peer by Public Key ```rust // client.rs use iroh::Endpoint; let ep = Endpoint::bind(presets::N0).await?; let conn = ep.connect(endpoint_id, b"iroh-example/echo/0").await?; let (mut send, mut recv) = conn.open_bi().await?; send.write_all(b"Hello, world!").await?; send.finish()?; let response = recv.read_to_end(1000).await?; assert_eq!(&response, b"Hello, world!"); ``` ### DNS-Based Address Lookup ```rust use iroh::{Endpoint, endpoint::presets}; use iroh::address_lookup::DnsAddressLookup; let mut builder = Endpoint::builder(presets::N0); builder.address_lookup(DnsAddressLookup::default()); // resolves via DNS let ep = builder.bind().await?; let conn = ep.connect(endpoint_id, b"my-protocol").await?; ``` ### Adding a Custom Transport ```toml # Cargo.toml iroh = { version = "0.1", features = ["tor"] } ``` ```rust use iroh::transport::tor::TorTransport; let mut builder = Endpoint::builder(presets::N0); builder.add_transport(TorTransport::new()); let ep = builder.bind().await?; ``` ## Summary - **Public-key identity**: Ed25519 keys serve as both `EndpointId` and network address, eliminating peer ID mapping layers found in [`iroh/src/lib.rs`](https://github.com/n0-computer/iroh/blob/main/iroh/src/lib.rs). - **Integrated connectivity**: Automatic hole punching with encrypted relay fallback built into the core stack at [`iroh/src/socket/transports/relay.rs`](https://github.com/n0-computer/iroh/blob/main/iroh/src/socket/transports/relay.rs). - **Lightweight cryptography**: QUIC authentication via noq instead of OpenSSL, reducing binary size below 2 MiB. - **Transport extensibility**: Custom transports plug in via the registry defined in [`TRANSPORTS.md`](https://github.com/n0-computer/iroh/blob/main/TRANSPORTS.md), unlike fixed multiaddr schemes. - **DNS resolution**: Pkarr-based lookup in [`iroh/src/address_lookup/dns.rs`](https://github.com/n0-computer/iroh/blob/main/iroh/src/address_lookup/dns.rs) replaces DHT maintenance. - **Modular architecture**: Protocols like iroh-blobs and iroh-gossip ship as independent crates for selective inclusion. ## Frequently Asked Questions ### How does iroh differ from libp2p? While libp2p uses multiaddr for transport agnosticism and requires separate peer ID resolution, iroh treats public keys as canonical addresses and maintains a transport registry in [`TRANSPORTS.md`](https://github.com/n0-computer/iroh/blob/main/TRANSPORTS.md). Additionally, iroh bundles hole punching and relay functionality natively rather than requiring external configuration. ### Can iroh work without internet connectivity or DHTs? Yes. iroh uses DNS-based address resolution via Pkarr records, allowing peers to discover each other through standard DNS infrastructure. Direct connections work over local networks using QUIC, and the relay system functions as long as at least one relay server is accessible. ### Is iroh suitable for mobile or embedded devices? Absolutely. The framework's use of the noq library and avoidance of heavyweight crypto providers keeps binaries under 2 MiB. The Rust-first implementation and minimal runtime make iroh ideal for resource-constrained environments where traditional P2P stacks would be too heavy. ### How does iroh handle NAT traversal compared to WebRTC? iroh implements automatic hole punching similar to WebRTC's ICE, but uses QUIC instead of SCTP for transport. The relay servers are encrypted and stateless, implemented in [`iroh-relay/src/server/http_server.rs`](https://github.com/n0-computer/iroh/blob/main/iroh-relay/src/server/http_server.rs), providing a fallback when direct connections fail without requiring complex TURN server configuration.