C03-GN: Yes
Rationale
Established CORE traffic encrypts and authenticates the carried protocol messages, including CADET routing/control contents, on each adjacency. GSC_KX_encrypt_and_transmit protects the inner message region and handle_encrypted verifies before dispatch. Outer IPv4/UDP addresses, lengths and CORE framing remain visible. This uses the same framing exception as the TLS/QUIC columns: protection from a passive observer without link keys, not concealment from the relay itself or protocol invisibility.
Assessment method
Pinned release-source analysis and primary protocol review; no runtime execution
Source context
src/core/gnunet-service-core_kx.c: GSC_KX_encrypt_and_transmit and handle_encrypted
Outstanding qualification
Capture established UDP/CORE traffic with and without endpoint keys, map exposed framing, and confirm inner CADET control fields are encrypted. Bootstrap and authorized relay inspection remain outside this positive result.