Add configurable packet authenticity settings

Localizable.xcstrings

@@ -13,6 +13,51 @@
     "Left %@" : {
       "comment" : "Geofence notification title when a node leaves the waypoint area. %@ is the waypoint name."
     },
+    "Balanced — Prefer authenticated" : {
+      "comment" : "Balanced packet authenticity policy option."
+    },
+    "Compatible — Accept unsigned" : {
+      "comment" : "Compatible packet authenticity policy option."
+    },
+    "Only processes remote mesh packets authenticated by a verified XEdDSA signature or successful PKI decryption. Unsigned positions, messages, telemetry, and other traffic are ignored; unsigned traffic from older or licensed (ham) nodes and packets too large to sign may disappear." : {
+      "comment" : "Description of the Strict packet authenticity policy."
+    },
+    "Packet Authenticity" : {
+      "comment" : "Security settings section title."
+    },
+    "Protection Level" : {
+      "comment" : "Label for the packet authenticity policy picker."
+    },
+    "Recommended. Rejects unsigned, signable broadcasts from nodes known to sign while accepting legacy unsigned traffic." : {
+      "comment" : "Description of the default Balanced packet authenticity policy."
+    },
+    "Require authentication for all remote packets?" : {
+      "comment" : "Strict packet authenticity confirmation title."
+    },
+    "Strict accepts only remote packets with a verified XEdDSA signature or successful PKI decryption. Unsigned positions, messages, telemetry, and other traffic from older firmware or nodes, licensed (ham) nodes, and packets too large to sign will be rejected. Authenticated PKI direct messages remain available." : {
+      "comment" : "Warning shown before enabling the Strict packet authenticity policy."
+    },
+    "Strict — Require authentication" : {
+      "comment" : "Strict packet authenticity policy option."
+    },
+    "The device has not reported XEdDSA capability. Update its firmware before changing this setting." : {
+      "comment" : "Explanation shown when an older radio has not reported packet-signing capability."
+    },
+    "This device reported a packet authenticity policy that this app version does not recognize." : {
+      "comment" : "Description shown for an unrecognized packet authenticity policy."
+    },
+    "This firmware build does not include XEdDSA packet signing, so this setting is unavailable." : {
+      "comment" : "Explanation shown when packet authenticity controls are unavailable on the connected radio."
+    },
+    "Unknown policy" : {
+      "comment" : "Fallback title for an unrecognized packet authenticity policy."
+    },
+    "Use Strict" : {
+      "comment" : "Confirms enabling the Strict packet authenticity policy."
+    },
+    "Verifies authentication when present and accepts unsigned traffic for maximum compatibility." : {
+      "comment" : "Description of the Compatible packet authenticity policy."
+    },
     "lockdown.backoff.body %lld" : {
       "extractionState" : "manual",
       "localizations" : {
@@ -103259,4 +103304,4 @@
     }
   },
   "version" : "1.1"
-}
+}

Meshtastic/Helpers/MeshPackets.swift

@@ -400,6 +400,7 @@ actor MeshPackets {
 				newMetadata.hasWifi = metadata.hasWifi_p
 				newMetadata.hasBluetooth = metadata.hasBluetooth_p
 				newMetadata.hasEthernet	= metadata.hasEthernet_p
+				newMetadata.hasXeddsa = metadata.hasXeddsa_p
 				newMetadata.role = Int32(metadata.role.rawValue)
 				newMetadata.positionFlags = Int32(truncatingIfNeeded: metadata.positionFlags)
 				newMetadata.excludedModules = Int32(truncatingIfNeeded: metadata.excludedModules)

Meshtastic/Model/ConfigModels.swift

@@ -336,6 +336,7 @@ final class SecurityConfigEntity {
 	var bluetoothLoggingEnabled: Bool = false
 	var debugLogApiEnabled: Bool = false
 	var isManaged: Bool = false
+	var packetSignaturePolicy: Int32 = 0
 	var privateKey: Data?
 	var publicKey: Data?
 	var serialEnabled: Bool = false

Meshtastic/Model/DeviceMetadataEntity.swift

@@ -17,6 +17,7 @@ final class DeviceMetadataEntity {
 	var hasBluetooth: Bool = false
 	var hasEthernet: Bool = false
 	var hasWifi: Bool = false
+	var hasXeddsa: Bool = false
 	var hwModel: String?
 	var positionFlags: Int32 = 0
 	var role: Int32 = 0

Meshtastic/Persistence/NodeBackupManager+Import.swift

@@ -122,6 +122,7 @@ extension NodeBackupManager {
 			dst.hasBluetooth = src.hasBluetooth
 			dst.hasEthernet = src.hasEthernet
 			dst.hasWifi = src.hasWifi
+			dst.hasXeddsa = src.hasXeddsa
 			dst.hwModel = src.hwModel
 			dst.positionFlags = src.positionFlags
 			dst.role = src.role

Meshtastic/Persistence/UpdateSwiftData.swift

@@ -1106,6 +1106,7 @@ extension MeshPackets {
 					newSecurityConfig.serialEnabled = config.serialEnabled
 					newSecurityConfig.debugLogApiEnabled = config.debugLogApiEnabled
 					newSecurityConfig.adminChannelEnabled = config.adminChannelEnabled
+					newSecurityConfig.packetSignaturePolicy = Int32(config.packetSignaturePolicy.rawValue)
 					fetchedNode[0].securityConfig = newSecurityConfig
 				} else {
 					fetchedNode[0].securityConfig?.publicKey = config.publicKey
@@ -1123,6 +1124,7 @@ extension MeshPackets {
 					fetchedNode[0].securityConfig?.serialEnabled = config.serialEnabled
 					fetchedNode[0].securityConfig?.debugLogApiEnabled = config.debugLogApiEnabled
 					fetchedNode[0].securityConfig?.adminChannelEnabled = config.adminChannelEnabled
+					fetchedNode[0].securityConfig?.packetSignaturePolicy = Int32(config.packetSignaturePolicy.rawValue)
 				}
 				if sessionPasskey?.count != 0 {
 					fetchedNode[0].sessionPasskey = sessionPasskey

Meshtastic/Resources/docs/index.json

@@ -397,36 +397,36 @@
         "keywords": [
             "app",
             "radio",
-            "device",
-            "node",
             "firmware",
-            "region",
+            "traffic",
+            "node",
+            "from",
+            "device",
+            "mesh",
             "position",
+            "nodes",
+            "region",
             "language",
-            "from",
             "settings",
-            "traffic",
-            "nodes",
-            "mesh",
+            "packets",
             "translation",
             "rate",
+            "only",
+            "default",
             "translated",
             "set",
-            "only",
+            "not",
+            "messages",
             "management",
             "enable",
             "documentation",
             "display",
-            "default",
             "connected",
             "configure",
-            "unknown",
-            "preset",
-            "pages",
-            "packets",
-            "module"
+            "available",
+            "unsigned"
         ],
-        "charCount": 8766
+        "charCount": 10284
     },
     {
         "id": "signal-meter",

Meshtastic/Resources/docs/markdown/user/settings.md

@@ -43,6 +43,20 @@ Manage up to 8 channels (0–7). Channel 0 is the primary broadcast channel. Add
 
 Configure PKI (Public Key Infrastructure) encryption for direct messages. Requires firmware 2.5+.
 
+#### Packet Authenticity
+
+Firmware that reports XEdDSA support can authenticate the sender of mesh packets. The **Protection Level** setting controls how the radio handles traffic that cannot be authenticated:
+
+| Level | Behavior |
+|-------|----------|
+| Compatible — Accept unsigned | Verifies authentication when present and accepts unsigned traffic for maximum compatibility. |
+| Balanced — Prefer authenticated | Recommended and the default. Rejects unsigned, signable broadcasts from nodes that have previously signed while continuing to accept legacy unsigned traffic. |
+| Strict — Require authentication | Accepts remote packets only when they have a verified XEdDSA signature or were successfully authenticated through PKI decryption. |
+
+Strict applies to every decryptable remote mesh packet, including positions, messages, telemetry, NodeInfo, and routing traffic. Unsigned traffic from older firmware or nodes, licensed (ham) nodes that do not sign, and packets too large to carry a signature will be rejected. Authenticated PKI direct messages remain available. The app asks for confirmation before enabling Strict.
+
+The selector is unavailable when a radio does not report XEdDSA capability. Update that radio's firmware before changing the policy. A verified signature proves which key sent a packet; it does not prove that a reported position or sensor value is true or fresh.
+
 On hardened lockdown-firmware radios, this page also shows a **Lockdown** section with the session status, a **Lock Now** button, and a **Forget Stored Passphrase** button. See [Lockdown Mode](lockdown.md).
 
 ### User
@@ -99,6 +113,7 @@ Optional feature modules. Only available when your connected node supports the m
 | Canned Messages | Pre-programmed message shortcuts accessible from the device buttons. |
 | Detection Sensor | Configure PIR motion or contact sensors. |
 | External Notification | Buzzer or LED alerts for incoming messages. |
+| Mesh Beacon | Advertise this node's mesh so other users' discovery scans can find and join it, and listen for beacons from nearby meshes. Requires firmware 2.8.0+. |
 | MQTT | Uplink/downlink messages to an MQTT broker for internet bridging. |
 | Neighbor Info | Periodically broadcasts information about directly-heard neighbors to help visualise mesh topology. Update interval ranges from 4 hours (default) to 72 hours. Enable **Transmit over LoRa** to share neighbour data over the radio in addition to MQTT and PhoneAPI. |
 | Range Test | Automated range testing with position logging. |

Meshtastic/Resources/docs/user/settings.html

@@ -52,6 +52,32 @@ <h3>Channels</h3>
 <p>Manage up to 8 channels (0–7). Channel 0 is the primary broadcast channel. Additional channels create isolated messaging groups with their own encryption keys.</p>
 <h3>Security</h3>
 <p>Configure PKI (Public Key Infrastructure) encryption for direct messages. Requires firmware 2.5+.</p>
+<h4>Packet Authenticity</h4>
+<p>Firmware that reports XEdDSA support can authenticate the sender of mesh packets. The <strong>Protection Level</strong> setting controls how the radio handles traffic that cannot be authenticated:</p>
+<table>
+<thead>
+<tr>
+<th>Level</th>
+<th>Behavior</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>Compatible — Accept unsigned</td>
+<td>Verifies authentication when present and accepts unsigned traffic for maximum compatibility.</td>
+</tr>
+<tr>
+<td>Balanced — Prefer authenticated</td>
+<td>Recommended and the default. Rejects unsigned, signable broadcasts from nodes that have previously signed while continuing to accept legacy unsigned traffic.</td>
+</tr>
+<tr>
+<td>Strict — Require authentication</td>
+<td>Accepts remote packets only when they have a verified XEdDSA signature or were successfully authenticated through PKI decryption.</td>
+</tr>
+</tbody>
+</table>
+<p>Strict applies to every decryptable remote mesh packet, including positions, messages, telemetry, NodeInfo, and routing traffic. Unsigned traffic from older firmware or nodes, licensed (ham) nodes that do not sign, and packets too large to carry a signature will be rejected. Authenticated PKI direct messages remain available. The app asks for confirmation before enabling Strict.</p>
+<p>The selector is unavailable when a radio does not report XEdDSA capability. Update that radio's firmware before changing the policy. A verified signature proves which key sent a packet; it does not prove that a reported position or sensor value is true or fresh.</p>
 <p>On hardened lockdown-firmware radios, this page also shows a <strong>Lockdown</strong> section with the session status, a <strong>Lock Now</strong> button, and a <strong>Forget Stored Passphrase</strong> button. See <a href="lockdown.html">Lockdown Mode</a>.</p>
 <h3>User</h3>
 <p>Set your Long Name (display name) and Short Name (4-character/emoji identifier shown in the node circle).</p>
@@ -142,6 +168,10 @@ <h2>Module Configuration</h2>
 <td>Buzzer or LED alerts for incoming messages.</td>
 </tr>
 <tr>
+<td>Mesh Beacon</td>
+<td>Advertise this node's mesh so other users' discovery scans can find and join it, and listen for beacons from nearby meshes. Requires firmware 2.8.0+.</td>
+</tr>
+<tr>
 <td>MQTT</td>
 <td>Uplink/downlink messages to an MQTT broker for internet bridging.</td>
 </tr>