Talero protects node sessions with hybrid key establishment, ML-DSA-65 authentication and encrypted application frames.
Public-safe is not unrestricted. Privacy, safe-mode, read-only, quota, role and gateway policies can still mask or deny a listed surface.
Talero negotiates session material through a hybrid X25519 + ML-KEM-768 exchange, binds ML-DSA-65 authentication to the session and encrypts application frames with ChaCha20-Poly1305.
Directional sequencing protects frame ordering. The capability is active at testnet maturity and internal to the node network.
Post-quantum authentication proves who joined the session. Authenticated encryption protects what nodes exchange after key establishment. Talero implements both rather than reducing P2P security to a signature label.
The public contract describes algorithms and guarantees, while peer identifiers, network addresses, topology, deployment configuration, access policy and operational procedures remain outside the public surface.
