V2 post-quantum transport — how every connection is encrypted

Every connection between INTcoin nodes is encrypted using post-quantum cryptography. There is no unencrypted transport option — V2 is the only supported protocol.

How It Works

When two nodes connect, they perform a handshake:

  1. Initiator generates an ephemeral Kyber1024 keypair and sends the public key (1,568 bytes)
  2. Responder encapsulates a shared secret using the initiator’s public key and sends back the ciphertext (1,568 bytes) plus their own ephemeral Kyber1024 public key
  3. Initiator decapsulates to recover the shared secret
  4. Both sides derive symmetric keys from the shared secret using HKDF
  5. All subsequent traffic is encrypted with ChaCha20-Poly1305 (authenticated encryption)

The entire handshake takes ~3,200 bytes and establishes:

  • Confidentiality — no one can read the traffic
  • Authenticity — messages can’t be tampered with (Poly1305 MAC)
  • Forward secrecy — ephemeral keys are discarded after the handshake; compromising a node’s long-term keys doesn’t decrypt past sessions

What This Means For You

  • Passive observers (ISPs, governments, network taps) cannot see which transactions you’re relaying, which blocks you’re requesting, or which peers you’re gossiping with
  • Active attackers cannot inject or modify messages without breaking the Poly1305 authentication
  • Quantum attackers cannot break the Kyber1024 key exchange — it’s based on the Module-LWE lattice problem, which has no known quantum speedup

Comparison

Bitcoin (V1) Bitcoin (V2/BIP324) INTcoin (V2)
Encryption None ChaCha20-Poly1305 ChaCha20-Poly1305
Key exchange None secp256k1 ECDH Kyber1024 KEM
Quantum-safe KE N/A No Yes
Forward secrecy N/A Yes Yes
Handshake size 0 ~128 bytes ~3,200 bytes

Bitcoin’s V2 transport (BIP324) is a significant improvement over plaintext but uses classical ECDH key exchange, which is vulnerable to quantum attack. INTcoin’s V2 uses Kyber1024, providing the same confidentiality guarantees even against quantum adversaries.

Verification

Check your connections are using V2:

intcoin-cli getpeerinfo

Every peer will show "transport_protocol_type": "v2". If you see anything else, something is wrong.