Security

Checks

dve security check

• node.key permissions (prefer 0600)
• config world-writability
• VPN port state
• full-tunnel without NAT warning

Primitives

• X25519 · HKDF-SHA256 · AES-256-GCM
• ChaCha20-Poly1305 (AEAD option)
• Ed25519 NodeID

Keys

• system: /var/lib/dve/identity/node.key
• user: ~/.dve/identity/node.key

Never commit keys. Bug reports (dve report) redact secrets.

Invites

dve vpn invite create --host vpn.example.com --ttl 3600
dve vpn invite revoke --token TOKEN