Security Model

Device identity uses long-term X25519 key pairs.
Device IDs are derived from the public key with BLAKE3 and URL-safe base64.
Peer sessions derive a symmetric key from X25519 shared secret material.
Tunnel payloads are sealed with ChaCha20-Poly1305.
The coordination server never receives session keys or VPN inner packets.
A server compromise can tamper with endpoint metadata, so clients must bind sessions to expected peer public keys from an invite or trusted group record.

MVP Limitations

The current handshake is Noise-style but not a full Noise protocol transcript.
There is no relay mode; if direct UDP paths fail, the peer remains offline.
Wintun packet IO is isolated behind an adapter boundary and still needs the production DLL integration layer.
Service API authorization is represented by bearer token configuration but not yet enforced by the in-memory MVP server.