Skip to content

Security model

Kaonic separates mesh data protection from local device management.

Mesh traffic

  • Reticulum provides identity-based addressing, encrypted links, and cryptographic destinations.
  • LDPC forward-error correction improves radio reliability; Reticulum protects the payload.
  • VPN peers can be restricted to an explicit list of Reticulum destination hashes.

Device management

Management services are intended for a trusted local network. Keep the Wi-Fi/USB management LAN restricted to authorised operators and use firewall rules when connecting a node to a larger network.

Operator responsibilities

  1. Change the default Linux password during commissioning.
  2. Set allow_all_peers = false and maintain a peer allowlist.
  3. Back up Reticulum identities before reflashing.
  4. Verify release checksums before installing images or packages.
  5. Remove a lost node from every remaining peer allowlist.
  6. Protect telemetry logs, identity files, and configuration backups as mission data.