Earlier quoted context omitted.
Every peer is identified by a curve25519 public key. To add someone as a friend, you add that public key. Connections between friends are encrypted. http://nacl.cr.yp.to/box.html is the crypto used. https://github.com/irungentoo/toxcore/blob/master/docs/Tox_m... describes the protocol used to connect securely to friends after they find themselves. This protocol has PFS, message padding to prevent length based leaking…
Are IP addresses encrypted in the DHT?
The only way to get the ip of someone from their Tox id is by knowing their public DHT key which they will only send you if they are your friend.
How this works is described in detail: https://github.com/irungentoo/toxcore/blob/master/docs/Preve...