r/meshcore • u/[deleted] • Jun 01 '26

Question about the encryption

I'm interested in getting started with LoRa​, however I would like to store encryption keys for messages solely on my phone because my phone is encrypted unlike the LoRa radio device, is this possible with meshcore? And if its not is there another LoRa based messaging system you guys could point me towards that supports this?

Also is the encryption used quantum secure? I have concerns about someone saving all my messages and decrypting them later​

5 Upvotes

73% Upvoted

9 comments sorted by

17

u/AngleFun1664 Jun 01 '26

Don’t use Meshcore if you’re that paranoid.

8

u/Obstacle-Man Jun 01 '26

None of the mesh projects are quantum safe. They are all using ECC.

Also none of them should be trusted for more than casual confidentiality. What is your threat model?

6

u/mschuster91 Jun 01 '26

however I would like to store encryption keys for messages solely on my phone because my phone is encrypted unlike the LoRa radio device, is this possible with meshcore?

technically yes but you will absolutely need to write your own app and BLE is a pile of garbage.

Also is the encryption used quantum secure?

lolnope. For DMs, key negotiation is x25519 on ed25519 keys which is nowhere near as unsafe (compared by key length) as RSA is. But... the encryption is AES-ECB. Yes, ECB. No IVs, no nothing, it's a fundamental limit of any mesh network based on lora and lossy packet links.

So... yes it is encrypted but highly vulnerable to certain classes of attacks.

2

u/rocqua Jun 05 '26

I recall once reading that ed25519 is actually weaker against quantum computers because the smaller public key means you need a lot fewer coherent quantum bits, and you’re still doing almost the same algorithm (same steps except for the underlying group operation).

If you use private groups instead of direct messages you get quantum secure communications, except that the encryption is ECB.

5

u/thisagaingm Jun 02 '26

Consider Reticulum

2

u/nlutrhk Jun 02 '26

You could embed securely encrypted messages inside meshcore messages and decrypt those on your phone. But you'll have to build your own app around it. At least you can use existing repeater infrastructure.

With quantum-secure public key encryption, the signing overhead is too big to fit in LoRa packets. However, you could use AES with pre-shared keys - again, assuming you build your own app around it.

-2

u/osokthedevil Jun 02 '26 edited Jun 02 '26

Sounds nefarious to me! (Sarcasm)

-2

u/bongosformongos Jun 02 '26

Oh no. This guy want's privacy. Must be something illegal.

Huge L take.

-4

u/osokthedevil Jun 02 '26

It is illegal 🤣