noise-ruby 0.10.1 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cffe6f7ffc789455f6b27bf3246cce8870cf57600e551d8f8edf91437ccd7afd
-  data.tar.gz: f9c83042c8aa626a7a6e81ad62dd64ccf6c5515c33f1f64e12904b2ffcaa5fa9
+  metadata.gz: 876220b34ef23fb45d18cb2dd0dfd7627b5bb202e51f57af9c0cd5a62c211626
+  data.tar.gz: 662c47506e70adf05928da7b8c5e3fb48503e0043242f4127459297e29dba476
 SHA512:
-  metadata.gz: a1c2fe0e62f0939b48052d348511a97cedcf222316491d43f1d6128d146108587eedeb972d1fbce732a15aa7b73684f76e013e7a57c2f27fe85a3f7331a140bd
-  data.tar.gz: fa9aea76917642726a8688fbc7b3d0f5fb9b32d1fe058ba7fbf81757d9754da92c1809633378b518753cf105e25e452f65975cfbef0f9b679ec12c68c5198d80
+  metadata.gz: 8db525a248cd3a66f1597736745d70470ef109a3e7c7acd9758fda79c5c45aa78350d833c38a4d6d3d2ae9f8a06dd3b6b7f89a6c4928c12ea3dfe899efca4906
+  data.tar.gz: 420bd4dbeff8a66570f9d71ec219375aafeb9e5a45d76b1f23f6d9dfe47776b73da860b918f585214983224fea488370dc423f27dbd7c8905c95f33d8a4dce13

data/.dockerignore

@@ -0,0 +1,8 @@
+# Gemfile.lock is deliberately not listed: the Dockerfile copies it so the image installs the same
+# versions the mounted working tree will ask for.
+.git/
+.rspec_status
+.ruby-lsp/
+coverage/
+pkg/
+tmp/

data/.github/workflows/ruby.yml

@@ -14,17 +14,43 @@ on:
     branches: [ master ]
 
 jobs:
-  test:
-
+  lint:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby:
+          - '3.3'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Ruby ${{ matrix.ruby }}
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - name: Lint code for consistent style
+        run: bundle exec rubocop -f github
 
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby:
+          - '3.0'
+          - '3.1'
+          - '3.2'
+          - '3.3'
+          - '3.4'
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: 2.6
-    - name: Install dependencies
-      run: bundle install
-    - name: Run tests
-      run: bundle exec rake
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Ruby ${{ matrix.ruby }}
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - name: Run tests
+        run: bundle exec rspec spec
+

data/.gitignore

@@ -10,3 +10,6 @@
 
 # rspec failure tracking
 .rspec_status
+
+AGENTS.md
+CLAUDE.md

data/.rubocop.yml

@@ -1,15 +1,11 @@
-Metrics/BlockLength:
+require:
+  - rubocop-rspec
+Metrics:
   Enabled: false
 
-Metrics/LineLength:
+Layout/LineLength:
   Max: 120
 
-Metrics/MethodLength:
-  Max: 30
-
-Metrics/AbcSize:
-  Max: 20
-
 Style/Documentation:
   Enabled: false
 
@@ -23,7 +19,30 @@ Style/WordArray:
   MinSize: 100
 
 AllCops:
-  TargetRubyVersion: 2.4.1
+  TargetRubyVersion: 3.0
+  SuggestExtensions: false
 
-Naming/UncommunicativeMethodParamName:
+Naming/MethodParameterName:
     MinNameLength: 1
+
+RSpec:
+  Exclude:
+    - "spec/factories/*"
+RSpec/AnyInstance:
+  Enabled: false
+RSpec/ContextWording:
+  Enabled: false
+RSpec/ExampleLength:
+  Enabled: false
+RSpec/MultipleExpectations:
+  Enabled: false
+RSpec/NamedSubject:
+  Enabled: false
+RSpec/NestedGroups:
+  Enabled: false
+RSpec/MultipleMemoizedHelpers:
+  Enabled: false
+RSpec/SpecFilePathFormat:
+  Enabled: false
+RSpec/IndexedLet:
+  Enabled: false

data/.ruby-version

@@ -1 +1 @@
-2.7.6
+3.3.5

data/Dockerfile

@@ -0,0 +1,29 @@
+# check=skip=FromPlatformFlagConstDisallowed
+# The test suite loads the x86_64 libsecp256k1 / libgoldilocks bundled in spec/lib, and
+# spec/spec_helper.rb points at them unconditionally, so this image has to be linux/amd64
+# even on an arm64 host. It mirrors the CI runner (ubuntu x86_64).
+FROM --platform=linux/amd64 ruby:3.3
+
+# libsodium: dlopen'd by rbnacl, which lib/noise.rb requires unconditionally.
+# cargo: the blake3 gem is a Rust extension and is built at install time.
+# git: noise.gemspec calls `git ls-files` while the gemspec is evaluated.
+RUN apt-get update -qq \
+ && apt-get install -y --no-install-recommends build-essential git libsodium23 cargo \
+ && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /work
+
+# Install the gems from the dependency definitions alone so the layer stays cached when only
+# the source changes. Gems live in BUNDLE_PATH (/usr/local/bundle), outside /work, so mounting
+# the working tree over /work at run time does not hide them.
+#
+# Gemfile.lock is gitignored, hence the glob: it is copied when the host has one so the image
+# installs the exact versions the mounted lock will ask for at run time, and skipped otherwise.
+COPY Gemfile* noise.gemspec ./
+COPY lib/noise/version.rb lib/noise/version.rb
+RUN bundle install
+
+# Run with the working tree mounted:
+#   docker run --rm -v "$PWD":/work noise-dev
+#   docker run --rm -v "$PWD":/work noise-dev bundle exec rubocop
+CMD ["bundle", "exec", "rspec"]

data/Gemfile

@@ -4,11 +4,6 @@ source 'https://rubygems.org'
 
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 
-# Specify your gem's dependencies in noise.gemspec
+# Specify your gem's dependencies in noise.gemspec. The optional ed448, secp256k1-ruby and blake3
+# backends are development dependencies there, so the test suite covers all of them.
 gemspec
-
-# Use secp256k1 as ecdh function
-# gem 'secp256k1-ruby'
-
-# Use blake3 as hash function
-# gem 'blake3'

data/README.md

@@ -59,6 +59,12 @@ After installing, define an environment variable as follows:
 
          $ export LIBGOLDILOCKS=/usr/local/lib/libgoldilocks.so
 
+and, add this line to your Gemfile:
+
+```
+gem 'ed448'
+```
+
 If you use Secp256k1, you must install [libsecp256k1](https://github.com/bitcoin-core/secp256k1).
 
     $ git clone https://github.com/bitcoin-core/secp256k1

data/lib/noise/connection/base.rb

@@ -3,10 +3,12 @@
 module Noise
   module Connection
     class Base
-      attr_reader :protocol, :handshake_started, :handshake_finished, :handshake_hash, :handshake_state
-      attr_reader :cipher_state_encrypt, :cipher_state_decrypt, :cipher_state_handshake
+      # The Noise spec caps a handshake or transport message at 65535 bytes.
+      MAX_MESSAGE_LENGTH = 65_535
+
+      attr_reader :protocol, :handshake_started, :handshake_finished, :handshake_hash, :handshake_state,
+                  :cipher_state_encrypt, :cipher_state_decrypt, :cipher_state_handshake, :s, :rs
       attr_accessor :psks, :prologue
-      attr_reader :s, :rs
 
       def initialize(name, keypairs: { s: nil, e: nil, rs: nil, re: nil })
         @protocol = Protocol.create(name)
@@ -27,11 +29,15 @@ module Noise
         @handshake_started = true
       end
 
+      # Restarts the handshake with a fallback pattern, carrying over the keys of the aborted one.
+      #
+      # The roles swap here: the party that wrote the aborted message now reads, and the one that
+      # failed to read it now writes. Both sides are already in that state, so @next_message is
+      # deliberately left as it is rather than reset through initialize_next_message.
       def fallback(fallback_name)
         @protocol = Protocol.create(fallback_name)
         @handshake_started = false
         @handshake_finished = false
-        # initialize_next_message
         @local_keypairs = { e: @handshake_state.e, s: @handshake_state.s }
         @remote_keys = { re: @handshake_state.re, rs: @handshake_state.rs }
         start_handshake
@@ -55,10 +61,13 @@ module Noise
         raise Noise::Exceptions::NoiseHandshakeError if @next_message != :write
         raise Noise::Exceptions::NoiseHandshakeError if @handshake_finished
 
+        if @handshake_state.expected_message_length(payload.bytesize) > MAX_MESSAGE_LENGTH
+          raise Noise::Exceptions::NoiseHandshakeError, 'Message exceeds the maximum length.'
+        end
+
         @next_message = :read
         buffer = +''
-        result = @handshake_state.write_message(payload, buffer)
-        @handshake_finished = true if result
+        @handshake_finished = @handshake_state.write_message(payload, buffer)
         buffer
       end
 
@@ -67,11 +76,12 @@ module Noise
         raise Noise::Exceptions::NoiseHandshakeError unless @handshake_started
         raise Noise::Exceptions::NoiseHandshakeError if @next_message != :read
         raise Noise::Exceptions::NoiseHandshakeError if @handshake_finished
+        raise Noise::Exceptions::NoiseHandshakeError, 'Message exceeds the maximum length.' if
+          data.bytesize > MAX_MESSAGE_LENGTH
 
         @next_message = :write
         buffer = +''
-        result = @handshake_state.read_message(data, buffer)
-        @handshake_finished = true if result
+        @handshake_finished = @handshake_state.read_message(data, buffer)
         buffer
       end
 
@@ -93,7 +103,7 @@ module Noise
         raise Noise::Exceptions::NoisePSKError if @protocol.pattern.psk_count != @psks.count
       end
 
-      def valid_keypairs?
+      def missing_keypairs?
         keypairs = @local_keypairs.merge(@remote_keys)
         @protocol.pattern.required_keypairs(initiator?).any? { |keypair| !keypairs[keypair] }
       end
@@ -101,7 +111,7 @@ module Noise
       def validate
         validate_psk! if @protocol.psk?
 
-        raise Noise::Exceptions::NoiseValidationError if valid_keypairs?
+        raise Noise::Exceptions::NoiseValidationError if missing_keypairs?
 
         true
       end

data/lib/noise/exceptions/decrypt_error.rb

@@ -4,6 +4,7 @@ module Noise
   module Exceptions
     class DecryptError < StandardError
       def initialize(cause)
+        super
         @cause = cause
       end
     end

data/lib/noise/exceptions/encrypt_error.rb

@@ -4,6 +4,7 @@ module Noise
   module Exceptions
     class EncryptError < StandardError
       def initialize(cause)
+        super
         @cause = cause
       end
     end

data/lib/noise/exceptions/invalid_public_key_error.rb

@@ -3,7 +3,10 @@
 module Noise
   module Exceptions
     class InvalidPublicKeyError < StandardError
+      attr_reader :public_key
+
       def initialize(public_key)
+        super("Invalid public key: #{public_key.unpack1('H*')}")
         @public_key = public_key
       end
     end

data/lib/noise/exceptions/missing_dependency_error.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Noise
+  module Exceptions
+    class MissingDependencyError < RuntimeError
+    end
+  end
+end

data/lib/noise/exceptions.rb

@@ -6,6 +6,7 @@ module Noise
     autoload :EncryptError, 'noise/exceptions/encrypt_error'
     autoload :InvalidPublicKeyError, 'noise/exceptions/invalid_public_key_error'
     autoload :MaxNonceError, 'noise/exceptions/max_nonce_error'
+    autoload :MissingDependencyError, 'noise/exceptions/missing_dependency_error'
     autoload :ProtocolNameError, 'noise/exceptions/protocol_name_error'
     autoload :NoiseHandshakeError, 'noise/exceptions/noise_handshake_error'
     autoload :NoiseValidationError, 'noise/exceptions/noise_validation_error'

data/lib/noise/functions/cipher/aes_gcm.rb

@@ -7,28 +7,29 @@ module Noise
         MAX_NONCE = 2**64 - 1
 
         def encrypt(k, n, ad, plaintext)
-          cipher = OpenSSL::Cipher::AES.new(256, :GCM).encrypt
+          cipher = OpenSSL::Cipher.new('aes-256-gcm').encrypt
           cipher.key = k
           cipher.iv = nonce_to_bytes(n)
           cipher.auth_data = ad
-          cipher.update(plaintext) + cipher.final + cipher.auth_tag
+          update(cipher, plaintext) + cipher.final + cipher.auth_tag
         rescue OpenSSL::Cipher::CipherError => e
           raise Noise::Exceptions::EncryptError, "Encrypt failed. #{e.message}", e.backtrace
         end
 
         def decrypt(k, n, ad, ciphertext)
-          cipher = OpenSSL::Cipher::AES.new(256, :GCM).decrypt
+          cipher = OpenSSL::Cipher.new('aes-256-gcm').decrypt
           cipher.key = k
           cipher.iv = nonce_to_bytes(n)
           cipher.auth_data = ad
-          cipher.auth_tag = ciphertext[-16..-1]
-          cipher.update(ciphertext[0...-16]) + cipher.final
+          cipher.auth_tag = ciphertext[-16..]
+          update(cipher, ciphertext[0...-16]) + cipher.final
         rescue OpenSSL::Cipher::CipherError => e
           raise Noise::Exceptions::DecryptError, "Decrpyt failed. #{e.message}", e.backtrace
         end
 
+        # 4 zero bytes followed by n as a big-endian 64 bit integer.
         def nonce_to_bytes(n)
-          "\x00" * 4 + format('%16x', n).htb
+          "\x00" * 4 + [n].pack('Q>')
         end
 
         # Returns a new 32-byte cipher key as a pseudorandom function of k.
@@ -40,6 +41,16 @@ module Noise
         def rekey(k)
           encrypt(k, MAX_NONCE, '', "\x00" * 32)[0...32]
         end
+
+        private
+
+        # A zero-length payload is normal in a Noise message, but the openssl gem shipped with
+        # Ruby 3.0 raises ArgumentError('data must not be empty') instead of returning ''.
+        def update(cipher, data)
+          return String.new if data.empty?
+
+          cipher.update(data)
+        end
       end
     end
   end

data/lib/noise/functions/cipher/cha_cha_poly.rb

@@ -20,8 +20,9 @@ module Noise
           raise Noise::Exceptions::DecryptError, "Decrpyt failed. #{e.message}", e.backtrace
         end
 
+        # 4 zero bytes followed by n as a little-endian 64 bit integer.
         def nonce_to_bytes(n)
-          "\x00" * 4 + format('%16x', n).htb.reverse
+          "\x00" * 4 + [n].pack('Q<')
         end
 
         # Returns a new 32-byte cipher key as a pseudorandom function of k.
@@ -31,7 +32,7 @@ module Noise
         # zerolen is a zero-length byte sequence, and zeros is a sequence of
         # 32 bytes filled with zeros.
         def rekey(k)
-          encrypt(k, MAX_NONCE, '', "\x00" * 32)[0..32]
+          encrypt(k, MAX_NONCE, '', "\x00" * 32)[0...32]
         end
       end
     end

data/lib/noise/functions/dh/ed448.rb

@@ -1,12 +1,17 @@
 # frozen_string_literal: true
 
-require_force('ed448') { Ed448.init }
+Noise.require_optional('ed448') { Ed448.init }
 
 module Noise
   module Functions
     module DH
       class ED448
-        DHLEN = Ed448::X448::X448_PRIVATE_BYTES
+        # Ed448::X448::X448_PRIVATE_BYTES, spelled out so this file loads without the gem.
+        DHLEN = 56
+
+        def initialize
+          Noise.optional_dependency!('ed448')
+        end
 
         def generate_keypair
           private_key = SecureRandom.random_bytes(DHLEN)

data/lib/noise/functions/dh/secp256k1.rb

@@ -1,11 +1,15 @@
 # frozen_string_literal: true
 
-require_force 'secp256k1'
+Noise.require_optional 'secp256k1'
 
 module Noise
   module Functions
     module DH
       class Secp256k1
+        def initialize
+          Noise.optional_dependency!('secp256k1')
+        end
+
         def generate_keypair
           group = ECDSA::Group::Secp256k1
           private_key = 1 + SecureRandom.random_number(group.order - 1)
@@ -19,7 +23,7 @@ module Noise
         def dh(private_key, public_key)
           key = ::Secp256k1::PublicKey.new(pubkey: public_key, raw: true)
           key.ecdh(private_key)
-        rescue ::Secp256k1::AssertError => _
+        rescue ::Secp256k1::AssertError
           raise Noise::Exceptions::InvalidPublicKeyError, public_key
         end
 

data/lib/noise/functions/hash/blake2s.rb

@@ -60,6 +60,7 @@ module Noise
         # @return context
         def init(out_len, key)
           raise ArgumentError if out_len.zero? || out_len > 32
+
           h = IV.dup
           h[0] ^= 0x01010000 ^ (key.size << 8) ^ out_len
           t = 0
@@ -168,6 +169,7 @@ module Noise
 
         class Context
           attr_accessor :b, :h, :t, :c, :out_len
+
           def initialize(b, h, t, c, out_len)
             @b = b
             @h = h

data/lib/noise/functions/hash/blake3.rb

@@ -1,13 +1,18 @@
 # frozen_string_literal: true
 
-require_force 'blake3'
+Noise.require_optional 'blake3'
 
 module Noise
   module Functions
     module Hash
       class Blake3
-        HASHLEN = 64
-        BLOCKLEN = 128
+        HASHLEN = 32
+        BLOCKLEN = 64
+
+        def initialize
+          Noise.optional_dependency!('blake3')
+        end
+
         def hash(data)
           ::Blake3.digest(data)
         end

data/lib/noise/functions/hash.rb

@@ -10,14 +10,17 @@ module Noise
       autoload :Blake3, 'noise/functions/hash/blake3'
 
       def self.hmac_hash(key, data, digest)
-        if digest.include?('SHA')
+        case digest
+        when /SHA/
           OpenSSL::HMAC.digest(OpenSSL::Digest.new(digest), key, data)
-        elsif digest.include?('BLAKE2b')
+        when /BLAKE2b/
           Noise::Functions::Hash::Blake2bHMAC.new(key).update(data).digest
-        elsif digest.include?('BLAKE2s')
+        when /BLAKE2s/
           Noise::Functions::Hash::Blake2sHMAC.new(key).update(data).digest
-        elsif digest.include?('BLAKE3')
+        when /BLAKE3/
           Noise::Functions::Hash::Blake3HMAC.new(key).update(data).digest
+        else
+          raise Noise::Exceptions::ProtocolNameError, "Unsupported hash function: #{digest}"
         end
       end
 
@@ -30,9 +33,10 @@ module Noise
       def self.hkdf(chaining_key, input_key_material, num_outputs, digest)
         temp_key = hmac_hash(chaining_key, input_key_material, digest)
         output1 = hmac_hash(temp_key, "\x01", digest)
-        output2 = hmac_hash(temp_key, output1 + "\x02", digest)
+        output2 = hmac_hash(temp_key, "#{output1}\u0002", digest)
         return [output1, output2] if num_outputs == 2
-        output3 = hmac_hash(temp_key, output2 + "\x03", digest)
+
+        output3 = hmac_hash(temp_key, "#{output2}\u0003", digest)
         [output1, output2, output3]
       end
     end

data/lib/noise/pattern.rb

@@ -50,6 +50,7 @@ module Noise
         'se'
       end
     end
+
     class TokenSS < TokenDH
       def get_key(keypair, _initiator)
         [keypair.s.private_key, keypair.rs]
@@ -59,6 +60,7 @@ module Noise
         'ss'
       end
     end
+
     class TokenPSK
       def to_s
         'psk'
@@ -77,6 +79,7 @@ module Noise
   module Modifier
     class Psk
       attr_reader :index
+
       def initialize(index)
         @index = index
       end
@@ -85,29 +88,39 @@ module Noise
     class Fallback
     end
 
+    PSK_REGEX = /\Apsk(\d+)\z/
+
     def self.parse(s)
-      if s.start_with?('psk')
-        index = s.gsub(/psk/, '').to_i
-        Modifier::Psk.new(index)
-      elsif s == 'fallback'
-        Modifier::Fallback.new
-      else
-        raise Noise::Exceptions::UnsupportedModifierError
-      end
+      matched = PSK_REGEX.match(s)
+      return Modifier::Psk.new(matched[1].to_i) if matched
+      return Modifier::Fallback.new if s == 'fallback'
+
+      raise Noise::Exceptions::UnsupportedModifierError, "Unsupported modifier: #{s}"
     end
   end
 
   class Pattern
-    attr_reader :tokens, :modifiers, :psk_count, :fallback
+    attr_reader :name, :tokens, :modifiers, :psk_count, :fallback
+
+    NAME_REGEX = /\A([A-Z1]+)([^A-Z]*)\z/
 
     def self.create(name)
-      pattern_set = name.scan(/([A-Z1]+)([^A-Z]*)/)&.first
-      pattern = pattern_set&.first
-      modifiers = pattern_set[1].split('+').map { |s| Modifier.parse(s) }
-      class_name = "Noise::Pattern#{pattern}"
-      klass = Object.const_get(class_name)
-      klass.new(modifiers)
+      matched = NAME_REGEX.match(name)
+      raise Noise::Exceptions::ProtocolNameError, "Malformed pattern name: #{name}" unless matched
+
+      modifiers = matched[2].split('+').map { |s| Modifier.parse(s) }
+      pattern_class(matched[1]).new(modifiers)
+    end
+
+    def self.pattern_class(pattern)
+      klass = Object.const_get("Noise::Pattern#{pattern}")
+      raise NameError unless klass.is_a?(Class) && klass < Pattern
+
+      klass
+    rescue NameError
+      raise Noise::Exceptions::ProtocolNameError, "Unsupported pattern: #{pattern}"
     end
+    private_class_method :pattern_class
 
     def initialize(modifiers)
       @pre_messages = [[], []]
@@ -126,7 +139,8 @@ module Noise
         case modifier
         when Modifier::Psk
           index = modifier.index
-          raise Noise::Exceptions::PSKValueError if index / 2 > @tokens.size
+          # psk0 prepends to the first message, pskN appends to the Nth one.
+          raise Noise::Exceptions::PSKValueError if index > @tokens.size
 
           if index.zero?
             @tokens[0].insert(0, Token::PSK)
@@ -147,24 +161,48 @@ module Noise
 
     def required_keypairs_of_initiator
       required = []
-      required << :s if %w[K X I].include?(@name[0])
-      required << :rs if one_way? || @name[1] == 'K'
+      required << :s if initiator_static?
+      required << :rs if responder_static_pre_shared?
       required
     end
 
     def required_keypairs_of_responder
       required = []
-      required << :rs if @name[0] == 'K'
-      required << :s if one_way? || %w[K X].include?(@name[1])
+      required << :rs if initiator_static_pre_shared?
+      required << :s if responder_static?
       required
     end
 
     def initiator_pre_messages
-      @pre_messages[0].dup
+      (@pre_messages[0] || []).dup
     end
 
     def responder_pre_messages
-      @pre_messages[1].dup
+      (@pre_messages[1] || []).dup
+    end
+
+    # A party needs a static keypair when its static public key is either pre-shared with the peer or
+    # transmitted during the handshake. Deriving this from the pattern itself keeps deferred patterns
+    # (whose names carry a '1', e.g. X1K) working, unlike inspecting single characters of the name.
+    def initiator_static?
+      initiator_static_pre_shared? || sends_static?(0)
+    end
+
+    def responder_static?
+      responder_static_pre_shared? || sends_static?(1)
+    end
+
+    def initiator_static_pre_shared?
+      initiator_pre_messages.include?(Token::S)
+    end
+
+    def responder_static_pre_shared?
+      responder_pre_messages.include?(Token::S)
+    end
+
+    # The initiator writes the messages at even indexes, the responder the ones at odd indexes.
+    def sends_static?(offset)
+      offset.step(@tokens.size - 1, 2).any? { |i| @tokens[i].include?(Token::S) }
     end
 
     def one_way?
@@ -173,10 +211,6 @@ module Noise
   end
 
   class OneWayPattern < Pattern
-    def initialize(modifiers)
-      super(modifiers)
-    end
-
     def one_way?
       true
     end

data/lib/noise/protocol.rb

@@ -6,27 +6,31 @@ module Noise
     attr_reader :name, :pattern
 
     CIPHER = {
-      'AESGCM': Noise::Functions::Cipher::AesGcm,
-      'ChaChaPoly': Noise::Functions::Cipher::ChaChaPoly
-    }.stringify_keys.freeze
+      'AESGCM' => Noise::Functions::Cipher::AesGcm,
+      'ChaChaPoly' => Noise::Functions::Cipher::ChaChaPoly
+    }.freeze
 
     DH = {
-      '25519': Noise::Functions::DH::ED25519,
-      '448': Noise::Functions::DH::ED448,
-      'secp256k1': Noise::Functions::DH::Secp256k1
-    }.stringify_keys.freeze
+      '25519' => Noise::Functions::DH::ED25519,
+      '448' => Noise::Functions::DH::ED448,
+      'secp256k1' => Noise::Functions::DH::Secp256k1
+    }.freeze
 
     HASH = {
-      'BLAKE2b': Noise::Functions::Hash::Blake2b,
-      'BLAKE2s': Noise::Functions::Hash::Blake2s,
-      'SHA256': Noise::Functions::Hash::Sha256,
-      'SHA512': Noise::Functions::Hash::Sha512,
-      'BLAKE3': Noise::Functions::Hash::Blake3
-    }.stringify_keys.freeze
+      'BLAKE2b' => Noise::Functions::Hash::Blake2b,
+      'BLAKE2s' => Noise::Functions::Hash::Blake2s,
+      'SHA256' => Noise::Functions::Hash::Sha256,
+      'SHA512' => Noise::Functions::Hash::Sha512,
+      'BLAKE3' => Noise::Functions::Hash::Blake3
+    }.freeze
 
     def self.create(name)
-      prefix, pattern_name, dh_name, cipher_name, hash_name = name.split('_')
-      raise Noise::Exceptions::ProtocolNameError if prefix != 'Noise'
+      parts = name.split('_')
+      raise Noise::Exceptions::ProtocolNameError, "Malformed protocol name: #{name}" unless parts.size == 5
+
+      prefix, pattern_name, dh_name, cipher_name, hash_name = parts
+      raise Noise::Exceptions::ProtocolNameError, "Malformed protocol name: #{name}" if prefix != 'Noise'
+
       new(name, pattern_name, cipher_name, hash_name, dh_name)
     end
 
@@ -43,7 +47,8 @@ module Noise
       @cipher_fn = CIPHER[cipher_name]&.new
       @hash_fn = HASH[hash_name]&.new
       @dh_fn = DH[dh_name]&.new
-      raise Noise::Exceptions::ProtocolNameError unless @cipher_fn && @hash_fn && @dh_fn
+      raise Noise::Exceptions::ProtocolNameError, "Unsupported function in: #{@name}" unless
+        @cipher_fn && @hash_fn && @dh_fn
     end
 
     def psk?

data/lib/noise/state/cipher_state.rb

@@ -10,10 +10,11 @@ module Noise
     #
     class CipherState
       MAX_NONCE = 2**64 - 1
+      TAG_LENGTH = 16
 
       attr_reader :k, :n
 
-      def initialize(cipher: AesGcm.new)
+      def initialize(cipher:)
         @cipher = cipher
       end
 
@@ -36,6 +37,7 @@ module Noise
       def encrypt_with_ad(ad, plaintext)
         return plaintext unless key?
         raise Noise::Exceptions::MaxNonceError if @n == MAX_NONCE
+
         ciphertext = @cipher.encrypt(@k, @n, ad, plaintext)
         @n += 1
         ciphertext
@@ -45,6 +47,10 @@ module Noise
       def decrypt_with_ad(ad, ciphertext)
         return ciphertext unless key?
         raise Noise::Exceptions::MaxNonceError if @n == MAX_NONCE
+        # Without this the ciphers slice a nil authentication tag out of the truncated input.
+        raise Noise::Exceptions::DecryptError, 'Ciphertext is shorter than the tag.' if
+          ciphertext.bytesize < TAG_LENGTH
+
         plaintext = @cipher.decrypt(@k, @n, ad, ciphertext)
         @n += 1
         plaintext

data/lib/noise/state/handshake_state.rb

@@ -17,8 +17,7 @@ module Noise
     # message_patterns: A sequence of message patterns.
     #     Each message pattern is a sequence of tokens from the set ("e", "s", "ee", "es", "se", "ss").
     class HandshakeState
-      attr_reader :message_patterns, :symmetric_state
-      attr_reader :s, :rs, :e, :re
+      attr_reader :message_patterns, :symmetric_state, :s, :rs, :e, :re
 
       def initialize(connection, initiator, prologue, local_keypairs, remote_keys)
         @connection = connection
@@ -32,8 +31,9 @@ module Noise
 
         initiator_keypair_getter, responder_keypair_getter = get_keypair_getter(initiator)
 
-        # Sets message_patterns to the message patterns from handshake_pattern
-        @message_patterns = @protocol.pattern.tokens.dup
+        # Sets message_patterns to the message patterns from handshake_pattern. The inner arrays are
+        # copied too, so consuming them here can never reach back into the shared Pattern.
+        @message_patterns = @protocol.pattern.tokens.map(&:dup)
 
         process_initiator_pre_messages(initiator_keypair_getter)
         process_fallback(initiator_keypair_getter)
@@ -49,11 +49,11 @@ module Noise
       end
 
       def local_keypair_getter
-        ->(token) { instance_variable_get('@' + token.to_s).public_key }
+        ->(token) { instance_variable_get("@#{token}").public_key }
       end
 
       def remote_keypair_getter
-        ->(token) { instance_variable_get('@r' + token.to_s) }
+        ->(token) { instance_variable_get("@r#{token}") }
       end
 
       def process_initiator_pre_messages(keypair_getter)
@@ -100,6 +100,7 @@ module Noise
       end
 
       # Takes a payload byte sequence which may be zero-length, and a message_buffer to write the output into
+      # @return [Boolean] true if this was the last handshake message, false otherwise.
       def write_message(payload, message_buffer)
         pattern = @message_patterns.shift
 
@@ -118,18 +119,18 @@ module Noise
           end
         end
         message_buffer << @symmetric_state.encrypt_and_hash(payload)
-        @symmetric_state.split if @message_patterns.empty?
+        finish_handshake
       end
 
       # Takes a byte sequence containing a Noise handshake message,
       # and a payload_buffer to write the message's plaintext payload into
+      # @return [Boolean] true if this was the last handshake message, false otherwise.
       def read_message(message, payload_buffer)
         pattern = @message_patterns.shift
         pattern.each do |token|
           case token
           when Noise::Token::E
-            message, re = extract_key(message, false)
-            @re ||= re
+            message, @re = extract_key(message, false)
             mix_e(@re)
           when Noise::Token::S
             message, @rs = extract_key(message, true)
@@ -140,11 +141,19 @@ module Noise
           end
         end
         payload_buffer << @symmetric_state.decrypt_and_hash(message)
-        @symmetric_state.split if @message_patterns.empty?
+        finish_handshake
       end
 
       private
 
+      # Splits into the transport cipher states once every message pattern has been processed.
+      def finish_handshake
+        return false unless @message_patterns.empty?
+
+        @symmetric_state.split
+        true
+      end
+
       def extract_key(message, is_encrypted)
         len = @protocol.dh_fn.dhlen
         offset =
@@ -153,8 +162,10 @@ module Noise
           else
             0
           end
+        raise Noise::Exceptions::NoiseHandshakeError, 'Message is too short.' if message.bytesize < len + offset
+
         key = message[0...len + offset]
-        message = message[(len + offset)..-1]
+        message = message[(len + offset)..]
         key = @symmetric_state.decrypt_and_hash(key) if is_encrypted
         [message, key]
       end

data/lib/noise/state/symmetric_state.rb

@@ -8,8 +8,7 @@ module Noise
     # - h: A hash output of HASHLEN bytes.
     #
     class SymmetricState
-      attr_reader :h, :ck
-      attr_reader :cipher_state
+      attr_reader :h, :ck, :cipher_state
 
       def initialize(protocol, connection)
         @protocol = protocol

data/lib/noise/utils/string.rb

@@ -1,11 +1,25 @@
 # frozen_string_literal: true
 
-class String
-  def htb
-    [self].pack('H*')
-  end
+module Noise
+  module Utils
+    # Hex conversion helpers. Offered as a refinement so that requiring this gem does not add methods
+    # to String for the whole process.
+    #
+    #   using Noise::Utils::HexString
+    #   '0102'.htb     # => "\x01\x02"
+    #   "\x01\x02".bth # => "0102"
+    module HexString
+      refine ::String do
+        # hex to binary
+        def htb
+          [self].pack('H*')
+        end
 
-  def bth
-    unpack('H*').first
+        # binary to hex
+        def bth
+          unpack1('H*')
+        end
+      end
+    end
   end
 end

data/lib/noise/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Noise
-  VERSION = '0.10.1'
+  VERSION = '0.11.0'
 end

data/lib/noise.rb

@@ -8,7 +8,6 @@ require 'rbnacl'
 require 'ruby_hmac'
 require 'securerandom'
 
-require 'noise/utils/hash'
 require 'noise/utils/string'
 
 module Noise
@@ -21,14 +20,29 @@ module Noise
   autoload :Functions, 'noise/functions'
   autoload :State, 'noise/state'
 
-  def self.logger
-    @logger ||= Logger.new(STDOUT)
-  end
-end
+  # Some DH and hash functions are backed by a gem, and often a system library, that is only needed
+  # when the function appears in a protocol name. Loading one is therefore allowed to fail; the
+  # failure is remembered and reported by optional_dependency! when the function is used.
+  @unavailable_dependencies = {}
+
+  class << self
+    def logger
+      @logger ||= Logger.new($stdout)
+    end
 
-def require_force(name)
-  require name
-  yield if block_given?
-rescue LoadError => e
-  Noise.logger.warn(e.message)
+    def require_optional(name)
+      require name
+      yield if block_given?
+    rescue LoadError => e
+      @unavailable_dependencies[name] = e.message
+      logger.warn("Optional dependency '#{name}' is unavailable: #{e.message}")
+    end
+
+    def optional_dependency!(name)
+      reason = @unavailable_dependencies[name]
+      return if reason.nil?
+
+      raise Noise::Exceptions::MissingDependencyError, "'#{name}' could not be loaded: #{reason}"
+    end
+  end
 end

data/noise.gemspec

@@ -5,7 +5,8 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require 'noise/version'
 
 Gem::Specification.new do |spec|
-  spec.name          = 'noise-ruby'
+  spec.name = 'noise-ruby'
+  spec.required_ruby_version = '~> 3.0'
   spec.version       = Noise::VERSION
   spec.authors       = ['Hajime Yamaguchi']
   spec.email         = ['gen.yamaguchi0@gmail.com']
@@ -21,14 +22,23 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.add_development_dependency 'blake3'
   spec.add_development_dependency 'bundler', '~> 2.0'
   spec.add_development_dependency 'rake', '>= 12.3.3'
   spec.add_development_dependency 'rspec', '~> 3.0'
+
+  spec.add_development_dependency 'rubocop'
+  spec.add_development_dependency 'rubocop-rspec'
+  spec.add_development_dependency 'simplecov'
+  spec.add_development_dependency 'simplecov-json'
+
+  # Optional backends. Each one is needed only when its function appears in a protocol name, and
+  # each also needs a system library that cannot be installed as a gem, so none of them is a runtime
+  # dependency. Add the one you need to your own Gemfile; see the README for the system libraries.
+  spec.add_development_dependency 'blake3'
+  spec.add_development_dependency 'ed448'
   spec.add_development_dependency 'secp256k1-ruby'
 
   spec.add_runtime_dependency 'ecdsa'
-  spec.add_runtime_dependency 'ed448'
   spec.add_runtime_dependency 'rbnacl'
   spec.add_runtime_dependency 'ruby-hmac'
 end

metadata

@@ -1,29 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: noise-ruby
 version: !ruby/object:Gem::Version
-  version: 0.10.1
+  version: 0.11.0
 platform: ruby
 authors:
 - Hajime Yamaguchi
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2022-08-27 00:00:00.000000000 Z
+date: 2026-07-31 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: blake3
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -67,7 +53,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '3.0'
 - !ruby/object:Gem::Dependency
-  name: secp256k1-ruby
+  name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -81,13 +67,55 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: ecdsa
+  name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  type: :runtime
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: simplecov-json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: blake3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
@@ -96,6 +124,34 @@ dependencies:
         version: '0'
 - !ruby/object:Gem::Dependency
   name: ed448
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: secp256k1-ruby
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: ecdsa
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -143,12 +199,14 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".dockerignore"
 - ".github/workflows/ruby.yml"
 - ".gitignore"
 - ".rspec"
 - ".rubocop.yml"
 - ".ruby-version"
 - CODE_OF_CONDUCT.md
+- Dockerfile
 - Gemfile
 - README.md
 - Rakefile
@@ -164,6 +222,7 @@ files:
 - lib/noise/exceptions/encrypt_error.rb
 - lib/noise/exceptions/invalid_public_key_error.rb
 - lib/noise/exceptions/max_nonce_error.rb
+- lib/noise/exceptions/missing_dependency_error.rb
 - lib/noise/exceptions/noise_handshake_error.rb
 - lib/noise/exceptions/noise_psk_error.rb
 - lib/noise/exceptions/noise_validation_error.rb
@@ -192,30 +251,29 @@ files:
 - lib/noise/state/cipher_state.rb
 - lib/noise/state/handshake_state.rb
 - lib/noise/state/symmetric_state.rb
-- lib/noise/utils/hash.rb
 - lib/noise/utils/string.rb
 - lib/noise/version.rb
 - noise.gemspec
 homepage: https://github.com/Yamaguchi/noise
 licenses: []
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - "~>"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key: 
+rubygems_version: 3.5.16
+signing_key:
 specification_version: 4
 summary: A Ruby implementation of the Noise Protocol framework
 test_files: []

data/lib/noise/utils/hash.rb

@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-class Hash
-  def stringify_keys
-    keys.each_with_object({}) do |key, h|
-      h[key.to_s] = self[key]
-    end
-  end
-end