Mesh privacy: channels, keys and what is never encrypted

The short version: a mesh is a shared radio channel. Anything on a default channel is public. A channel with your own key keeps the message text private from people without the key, with real limits. Do not treat it like Signal.

Research-based, from the Meshtastic and MeshCore documentation. We have not audited either system.

Default channels are public

• Meshtastic documents its default primary channel key (shown as AQ==) as published. Anyone can read traffic sent with it.
• MeshCore’s FAQ publishes the default public channel key, so the default channel should be treated as public.

Use the default channel to meet your local mesh. Use a private channel for anything you would not post on a bulletin board.

Private channels on Meshtastic

Per Meshtastic’s channel and encryption docs:

• Each channel has a pre-shared key. A 16-byte key gives AES-128, a 32-byte key AES-256.
• Anyone with the key can read every message on the channel. Share it in person, and change it when someone leaves the group.
• The packet header is never encrypted, because relaying radios need it.
• On firmware 2.8.1 and later, a channel can use an authenticated mode that rejects altered or forged packets. Every radio on the channel must match.

Direct messages on Meshtastic

Meshtastic gives each radio its own key pair. Two radios agree a shared key using X25519 and encrypt direct messages with AES-256-CCM, so only the two of them can read it.

The limits the docs themselves list:

• No forward secrecy. If a key leaks later, recorded messages can be decrypted.
• Trust on first use. A radio trusts the first public key it receives for a node. For anything sensitive, confirm the other person’s key through another route first.
• Not equivalent to Signal, TLS 1.3 or WPA3, by the project’s own answer.

MeshCore

MeshCore’s FAQ calls it a system for “secure text-based communications” and publishes its default public channel key. The FAQ’s packet reference lists encrypted fields and a message authentication code for direct and group messages, and says adverts are signed. We did not find a description of the cipher or key exchange in the FAQ, so we do not rate it against Meshtastic here.

Practical rules

1. Private channel for family or group messages, key shared in person.
2. Rotate the key when someone leaves or a radio is lost.
3. No private channel on an unattended repeater. Meshtastic warns that physical access can expose the key. Repeaters forward packets without reading them.
4. Check what your radio broadcasts. Name, position and telemetry can go out on the mesh. Turn off what you do not want shared.
5. Licensed operators cannot encrypt. 47 CFR 97.113(a)(4) bars messages encoded to obscure their meaning, and Meshtastic’s licensed mode turns encryption off. See the US rules.
6. Not for emergencies alone. A mesh does not reach 911 unless someone on it relays your message.