BIP324 (v2 Encrypted P2P Transport)

BIP324 defines Bitcoin's version-2 (v2) peer-to-peer transport: an encrypted message layer that replaces the original plaintext v1 protocol used between full nodes. It provides confidentiality against passive eavesdroppers and makes the connection bytestream look like uniform random data, so deep-packet-inspection tooling can no longer fingerprint Bitcoin traffic by its fixed magic bytes and predictable message structure. Encryption is opportunistic and unauthenticated by default: any two upgraded peers negotiate it automatically, with no certificates, no key registration, and no trusted setup.

Why plaintext was a problem

Bitcoin's original transport sent every message in the clear. Anyone on the path — an ISP, a datacenter operator, a state-level observer — could read exactly which transactions and blocks a node relayed and when, and could identify Bitcoin connections at a glance from the protocol's telltale framing. That enabled cheap, dragnet-scale surveillance: linking transactions to the IP addresses that first announced them, mapping the network's topology, or selectively censoring Bitcoin traffic. A tamper-capable observer could even inject or modify messages without either peer noticing. BIP324 was designed to make all of that categorically more expensive.

How the handshake works

The key exchange uses X-only Elliptic-Curve Diffie-Hellman over the secp256k1 curve — the same curve Bitcoin uses for signatures — with each party's ephemeral public key encoded via ElligatorSwift so the handshake bytes are indistinguishable from random data. The shared secret is run through HKDF-SHA256 to derive independent per-direction session keys, a session ID, and garbage terminators used during the handshake. Message payloads are sealed with the ChaCha20-Poly1305 authenticated cipher, while a separate ChaCha20 keystream encrypts each message's length prefix so even the sizes of messages are not directly legible on the wire. Session keys are rotated periodically within a connection to limit the value of any single key compromise. The v2 transport also introduces a more compact message-type encoding, recovering some of the bandwidth overhead the encryption adds.

What it does and does not protect

v2 transport defeats passive surveillance outright: an observer sees only random-looking bytes. Tampering is no longer free either — because the handshake is unauthenticated, a man-in-the-middle attack remains theoretically possible, but the attacker must now be active on the path for the whole session, which is detectable in principle (peers can compare session IDs out-of-band) and far riskier than silent wiretapping. What v2 does not do by itself is prove a peer's identity, and it does not hide the fact that you are connecting to a known Bitcoin node's IP address — traffic analysis and endpoint metadata remain, which is why operators with stronger threat models layer it with onion routing. Nodes advertise v2 support through a dedicated service flag and fall back gracefully to v1 when a peer has not upgraded.

Why it matters for node runners

If you run a node at home, enabling v2 connections (on by default in recent Bitcoin Core releases) means your ISP can no longer trivially catalogue your transaction relay, and network-wide observers lose their cheapest data source. It hardens the environment that related privacy work assumes, and it complements defences against man-in-the-middle attacks and eclipse attacks at the connection layer. For transaction-origination privacy, see Dandelion (BIP156); for how light wallets fetch data without revealing their addresses, see Compact Block Filters (BIP158). Each of these closes a different leak; BIP324 closes the biggest and oldest one — the wire itself.

Checking your own node is straightforward: recent Bitcoin Core versions report each peer's transport version, so a glance at your peer list shows how many of your connections are already encrypted. Expect the share to keep climbing as the network upgrades — and expect v1 plaintext connections to look increasingly anomalous over time, the way unencrypted web traffic does today. Protocol privacy, like most privacy, works best when it is the unremarkable default.