Role
DVeProto contains the v2 handshake, NodeIdentity, session key derivation, frame protection, carriers, and test vectors. DVeMesh delegates encrypted peer sessions to those protocol mechanisms rather than defining a separate cipher suite.
Implemented primitives
The current v2 handshake source uses Ed25519 signatures, ephemeral X25519, HKDF-SHA256, and AES-GCM or ChaCha20-Poly1305 AEAD. The Finished message is an HMAC-SHA256 over the handshake transcript. Encrypted frames use sequence checking and a replay window.
Identity boundary
The generic v2 ClientHello contains the client's claimed NodeID but does not include an Ed25519 signature proving ownership of that identity. The ServerHello is signed and lets a client authenticate the server when it checks the expected NodeID. DVeVPN adds a separate client proof before its admission path. DVeMesh has a separate signed peer identity confirmation after the handshake. These guarantees are consumer-specific.
Compatibility
Wire compatibility is governed by DVeProto version and suite negotiation, not by Eryon’s own package version. The current tree does not establish a stable public compatibility matrix for separately installed Eryon, DVeMesh, and DVeProto distributions.
Source references
Primary inspected sources include DVeProto/v2/handshake.py, DVeMesh peer session code, and the Eryon security model. The security notes describe the limits of the reviewed path.