RustDesk — Hardened Fork

A security-hardened, direct-IP-only fork of RustDesk 1.4.7. You reach a known host by its IP address, and every connection is mutually password-authenticated by a mandatory CPace PAKE before application traffic is admitted.

This is not upstream RustDesk, and the upstream tagline does not describe it. There is no rendezvous/relay server, no public ID, no LAN discovery, no auto-updater, no plugin loader, no 2FA/OTP, and no key or server override — those paths are deleted from the source tree (removed, not merely disabled).

Security design

• One mandatory balanced PAKE — CPace over ristretto255 + SHA-512 (CFRG draft), enforced at the transport choke point before any application message, on every transport, with no legacy fallback. No password hash ever touches the wire. R-V3 remains outstanding: the required external expert audit has not happened. The exact-commit external audit handoff and mandatory scope records that release blocker.
• Direct transport. The…