E02-MT: Pending
Rationale
Kantilasa, Agussalim and Junaidi published a replay/tamper study (bit-Tech, DOI 10.32877/bt.v9i1.3847, 10 August 2026). The deposited abstract explicitly studies Meshtastic 2.6.11 shared-key channel messages and proposes a counter/HMAC modification. That is a different security mode from the selected 2.8.1 strict-signature PKI direct-message profile. Separately, official advisory GHSA-377p-prwp-4hwf documents direct-message fallback to legacy channel encryption and reports a fix in 2.7.15. It credits reporters and remediation developers, but does not establish an independent audit of the current selected composition.
Assessment method
External evidence scope triage, not full-paper audit or local experiment
Source context
Publisher-deposited Crossref abstract and official Meshtastic advisory; full paper unavailable (HTTP 403)
Outstanding qualification
Do not transfer shared-key-channel attack results to PKI direct messages, or classify the pinned later version as vulnerable from an older-version advisory. Full article and publisher page returned HTTP 403; only publisher-deposited metadata/abstract were recovered, so detailed methods, independence/conflict declarations and applicability could not be assessed. Obtain a third-party analysis mapped to the selected PKI/signature mechanisms before changing E02. Absence of a qualifying report in this search is not proof that none exists.
Public sources
- https://doi.org/10.32877/bt.v9i1.3847
- https://github.com/meshtastic/firmware/security/advisories/GHSA-377p-prwp-4hwf
- https://api.crossref.org/works/10.32877/bt.v9i1.3847
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round331-sources.json