PKI Direct Messaging (v2.3+)

Meshtastic firmware 2.3 introduced PKI-based encryption for direct (person-to-person) messages. This is a significant security upgrade that provides forward secrecy for DMs — something not possible with channel PSK encryption.

How PKI DMs Work

Each Meshtastic node generates a unique Curve25519 keypair on first boot:

1. Key generation — Node generates a private key (stored locally, never transmitted) and a public key.
2. Key exchange — Each node broadcasts its public key as part of its node info advertisement. Other nodes store this public key in their node database.
3. Message encryption — When you send a DM to another node, Meshtastic performs an ECDH key exchange using your private key and the recipient's public key, deriving a unique shared secret. This shared secret is used as the AES session key for that message.
4. Forward secrecy — Each message (or message session) can use a fresh key derivation. If a session key is compromised, it does not expose past messages.

Requirements for PKI DMs

• Both sender and recipient must be running Meshtastic firmware 2.3 or later
• The recipient's public key must be in the sender's node database (requires having received at least one advertisement from the recipient node)
• Both nodes must be on compatible channels (or direct radio range) for key advertisements to propagate

Enabling and Verifying PKI DMs

PKI DMs are enabled by default in firmware 2.3+. No configuration is required. The Meshtastic app shows a lock icon or "encrypted" indicator on DMs that use PKI encryption. If the recipient's public key is not yet known, the app may fall back to channel-encrypted DMs or prompt you to wait for a key exchange.

Comparison: PSK Channel vs PKI DM Security

Practical Recommendations

• For sensitive one-on-one communication, use DMs with firmware 2.3+ on both ends
• For group communication, use a custom channel with a randomly generated PSK distributed via secure channels
• Never put truly sensitive information on the Default channel — it is effectively unencrypted
• Rotate channel PSKs periodically for long-running networks where membership changes