PKC Direct Messaging (v2.5+)

Meshtastic v2.5 introduced Public Key Cryptography (PKC) encrypted direct messages - a significant security upgrade that makes DMs genuinely end-to-end encrypted rather than just channel-scoped.

Note on terminology: This feature is officially called "PKC Direct Messages" or "encrypted direct messages" in Meshtastic documentation. It was introduced in firmware v2.5, not v2.3 as some sources incorrectly state.

Before v2.5: How DMs Worked

Prior to v2.5, "direct messages" in Meshtastic were standard channel messages with a to field set to the recipient's node ID. Anyone on the same channel with the channel key could decrypt and read all DMs. There was no per-recipient encryption.

v2.5+: PKC Encrypted Direct Messages

From v2.5 onward, direct messages use per-node asymmetric encryption:

• Key exchange: X25519 ECDH - each node has an X25519 public/private key pair
• Encryption: AES-CCM - using the derived shared secret as the key
• Only the intended recipient can decrypt the message - the channel key is not used
• Node public keys are distributed automatically via NodeInfo packets

Backward Compatibility

If you send a PKC-encrypted DM to a node running firmware 2.4.3 or older, Meshtastic automatically falls back to the legacy channel-based method. The sender's app indicates which method is being used.

Requirements

• Both sender and recipient must be running Meshtastic firmware v2.5 or later
• Both nodes must have exchanged NodeInfo packets (public keys are included automatically)
• Compatible with Android, iOS, and Python CLI clients that support v2.5+

Source: meshtastic.org/docs/overview/encryption/ and meshtastic.org/blog/introducing-new-public-key-cryptography-in-v2_5/. Verified 2026-05-03.