# Encryption in Holepunch

## Layers

- **Noise**: Conn handshake (X25519)
- **SecretStream**: Stream AEAD (ChaCha20)
- **Core Block**: Opt encryptionKey
- **Blind**: Pairing w/ ephemeral keys

**E2EE**: No server trust, metadata min.