Mesh network, individual applications, and Bluetooth 5 devices are all secure.  This cannot be switched off or reduced in anyway.

• All mesh messages are encrypted and authenticated.
• Network security, application security, and device security are addressed independently.
• Security keys can be changed during the life of the mesh network via a Key Refresh procedure.
• Message obfuscation makes it difficult to track messages sent within the network providing a privacy mechanism to make it difficult to track nodes.
• Mesh security protects the network against replay attacks.
• The process by which devices are added to the mesh network to become nodes, is itself a secure process.
• Nodes can be removed from network securely, in a way which prevents trash can attacks.

Three security keys provide security to different aspects of the mesh and achieve a critical capability in mesh security, that of “separation of concerns”.

• NetKey (network key) possessed by all nodes. It allows a node to decrypt and authenticate up to the Network Layer. A Relay node uses NetKey to decrypt and authenticate messages before relaying.
• AppKey (application key). Application data for specific application can only be decrypted by nodes possess the right AppKey.
• DevKey (device key) is unique to each node. It is used for secure communication with the Provisioner during provisioning process.

In a mesh network with many nodes, a lot of processing power is required for decryption and authentication at least for the Relay nodes and possibly for other nodes. Phantom  is embedded with an ARM CryptoCell-310 cryptographic co-processor. To achieve acceptable mesh network performance, Phantom should be used in mesh networks with many nodes.