Evaluation and Mitigation of Replay and Tamper Attacks on Meshtastic Protocol

Abstract

Meshtastic is a LoRa-based mesh communication protocol designed for long-range communication in off-grid environments without internet infrastructure. In Meshtastic version 2.6.11, Channel Message communication uses AES256-CTR encryption with a shared Pre-Shared Key (PSK). Although AES-CTR preserves data confidentiality, it does not provide authentication or integrity protection. In addition, the existing packet deduplication mechanism only operates within a limited time window, causing packet freshness to not be reliably guaranteed. Consequently, Channel Message communication remains vulnerable to replay and tamper attacks. This study evaluates replay and tamper vulnerabilities in Meshtastic Channel Message communication using a controlled three-node topology with packet sizes of 16, 32, and 64 bytes. Replay attacks were performed by retransmitting captured packets after a 15-minute delay, while tamper attacks were conducted through bit-flipping modifications on encrypted packets. The results showed that Meshtastic version 2.6.11 accepted all replayed and manipulated packets under the tested conditions. To mitigate these vulnerabilities, this study proposes a firmware-level security enhancement called Meshtastic SHA256 through the implementation of a 32-bit Frame Counter and HMAC-SHA256. Experimental results showed that all replayed packets with outdated counter values and manipulated packets with invalid HMAC digests were successfully rejected for all tested packet sizes. The proposed mechanism introduced an additional overhead of 12 bytes per packet, while sender-side and receiver-side execution overheads remained below 6% and 15%, respectively. These findings indicate that the proposed mechanism substantially improves replay and tamper attack resistance under the evaluated experimental conditions while remaining suitable for ESP32-based LoRa devices.