DVeMeshEncryption
User payloads are sealed by DVeProto sessions (AES-256-GCM or ChaCha20-Poly1305). Control never sees those keys.
Trust boundary
Security
DVeMesh administers membership. DVeProto protects the overlay. Control never holds device private keys.
Device identity
Ed25519 NodeID generated on the device. Control stores the public NodeID only.
Authentication
Accounts use Argon2id. Browser sessions are hashed, HttpOnly cookies plus CSRF. Devices use hashed bearer tokens.
Authorization
Every network route checks membership role. Cross-account device reads return 404.
Network isolation
Peer lists, DVeIP, and ACL are scoped by network_id. No cross-tenant directory.
Secure sessions
Login mints a new session and revokes the previous cookie. Logout and expiry return 401.
DVeProto security
Handshake 2.0 signs the peer NodeID. A stolen enrollment token can add an attacker device; it cannot steal other devices’ private keys.