noise-ruby 0.11.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 876220b34ef23fb45d18cb2dd0dfd7627b5bb202e51f57af9c0cd5a62c211626
-  data.tar.gz: 662c47506e70adf05928da7b8c5e3fb48503e0043242f4127459297e29dba476
+  metadata.gz: 326691ebec86a68d5b4978756edcd5752c7307e4eba85c615e08262f8133481e
+  data.tar.gz: 0626adc9ec4b0821211b04b3573a950684ca526edcd5e956450107d4d8c69ce0
 SHA512:
-  metadata.gz: 8db525a248cd3a66f1597736745d70470ef109a3e7c7acd9758fda79c5c45aa78350d833c38a4d6d3d2ae9f8a06dd3b6b7f89a6c4928c12ea3dfe899efca4906
-  data.tar.gz: 420bd4dbeff8a66570f9d71ec219375aafeb9e5a45d76b1f23f6d9dfe47776b73da860b918f585214983224fea488370dc423f27dbd7c8905c95f33d8a4dce13
+  metadata.gz: 2246a0d4be698a11efb560f6e9ddd70b50a926255c32877d8fd7346780e99e4d2950ac2e10ed81fb787ce9a61f626027e69136e94d680c9959e79c1702c73c47
+  data.tar.gz: fe3e968bbb464d11bd574750bdd97410b7ef5564328b327946654f76f8476fae4eadb7fbb8acebf4c4036b4f5edaa2d4a5b265c38705cc2ad33e25f310f78255

data/.github/workflows/ruby.yml

@@ -19,7 +19,7 @@ jobs:
     strategy:
       matrix:
         ruby:
-          - '3.3'
+          - '4.0'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -37,11 +37,10 @@ jobs:
     strategy:
       matrix:
         ruby:
-          - '3.0'
-          - '3.1'
           - '3.2'
           - '3.3'
           - '3.4'
+          - '4.0'
     steps:
       - name: Checkout code
         uses: actions/checkout@v4

data/.rubocop.yml

@@ -19,7 +19,7 @@ Style/WordArray:
   MinSize: 100
 
 AllCops:
-  TargetRubyVersion: 3.0
+  TargetRubyVersion: 3.2
   SuggestExtensions: false
 
 Naming/MethodParameterName:

data/.ruby-version

@@ -1 +1 @@
-3.3.5
+4.0.6

data/Dockerfile

@@ -1,8 +1,7 @@
-# check=skip=FromPlatformFlagConstDisallowed
-# The test suite loads the x86_64 libsecp256k1 / libgoldilocks bundled in spec/lib, and
-# spec/spec_helper.rb points at them unconditionally, so this image has to be linux/amd64
-# even on an arm64 host. It mirrors the CI runner (ubuntu x86_64).
-FROM --platform=linux/amd64 ruby:3.3
+# A Linux environment close to the CI runner, for checking a change against the Ruby version CI
+# lints with. Nothing in the suite is architecture specific, so the image builds for the host
+# architecture and needs no emulation.
+FROM ruby:4.0
 
 # libsodium: dlopen'd by rbnacl, which lib/noise.rb requires unconditionally.
 # cargo: the blake3 gem is a Rust extension and is built at install time.

data/Gemfile

@@ -4,6 +4,6 @@ source 'https://rubygems.org'
 
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 
-# Specify your gem's dependencies in noise.gemspec. The optional ed448, secp256k1-ruby and blake3
-# backends are development dependencies there, so the test suite covers all of them.
+# Specify your gem's dependencies in noise.gemspec. The optional blake3 backend is a development
+# dependency there, so the test suite covers it too.
 gemspec

data/README.md

@@ -30,6 +30,9 @@ Supported Features:
 
 ## Installation
 
+This gem requires Ruby 3.2 or later, and is tested on 3.2, 3.3, 3.4 and 4.0. Ruby 3.0 and 3.1 are
+past end of life and are no longer supported; stay on noise-ruby 0.12.0 or earlier if you need them.
+
 This gem needs libsodium library.
 To install libsodium, see https://github.com/jedisct1/libsodium
 
@@ -47,39 +50,6 @@ Or install it yourself as:
 
     $ gem install noise-ruby
 
-If you use Ed448 as DH function, you must install [libgoldilocks](https://github.com/otrv4/libgoldilocks).
-
-After installing, define an environment variable as follows:
-
-   * on macOS
-
-         $ export LIBGOLDILOCKS=/usr/local/lib/libgoldilocks.dylib
-
-   * on Linux(Ubuntu)
-
-         $ export LIBGOLDILOCKS=/usr/local/lib/libgoldilocks.so
-
-and, add this line to your Gemfile:
-
-```
-gem 'ed448'
-```
-
-If you use Secp256k1, you must install [libsecp256k1](https://github.com/bitcoin-core/secp256k1).
-
-    $ git clone https://github.com/bitcoin-core/secp256k1
-    $ cd secp256k1
-    $ ./autogen.sh
-    $ ./configure --enable-module-recovery --enable-experimental --enable-module-ecdh
-    $ make
-    $ sudo make install
-
-and, add this line to your Gemfile:
-
-```
-gem 'secp256k1-ruby'
-```
-
 If you use BLAKE3, you must install [Rust and Cargo](https://www.rust-lang.org/tools/install).
 And add this line to your Gemfile:
 
@@ -93,6 +63,25 @@ Followings shows handshake protocol with "Noise_NN_25519_ChaChaPoly_BLAKE2b"
 
 ### Handshake
 
+#### Supplying keys
+
+Patterns other than `NN` need keys before the handshake starts. `Connection::Initiator.new` and
+`Connection::Responder.new` take them in the `keypairs:` hash: `:s` is the local static private key,
+`:rs` and `:re` are the remote party's static and ephemeral public keys.
+
+```
+initiator = Noise::Connection::Initiator.new("Noise_XX_25519_ChaChaPoly_SHA256", keypairs: { s: static_private_key })
+```
+
+`keypairs:` also accepts `:e`, the local ephemeral private key. **It exists only so that
+`spec/vectors_spec.rb` can reproduce the official test vectors, which fix both sides' ephemeral keys
+to make the output deterministic. Never set it in production.** A connection created with `:e` reuses
+that ephemeral keypair instead of generating a fresh one per handshake, which destroys the forward
+secrecy every pattern depends on: an attacker who recovers the key can decrypt every session that
+used it, past and future. Nothing fails and no warning is printed - the handshake still succeeds and
+your own tests still pass - so the loss is invisible. Leave `:e` unset and let the library generate
+it.
+
 #### initiator
 
 ```
@@ -138,6 +127,31 @@ cipher = initiator.encrypt("Hello, World!") # => "\xDA\xC7\xD7as\v\xFA\xCC,\xB3\
 plain = responder.decrypt(cipher) # => "Hello, World!"
 ```
 
+#### Out-of-order transport messages
+
+Each party counts the transport messages of each direction with a nonce. If the transport layer can
+deliver messages out of order or lose them, it has to carry the nonce of each message, and the
+receiver sets the nonce before decrypting. Restore the previous value if the message fails to
+authenticate, so that the following messages are still decryptable.
+
+```
+initiator.encryption_nonce # => 0
+responder.decryption_nonce = 2 # decrypt the message numbered 2 next
+plain = responder.decrypt(cipher)
+```
+
+#### Rekey
+
+Rekeying replaces the key of one direction with `REKEY(k)`, so that a key compromised later cannot
+decrypt the messages that came before it. The nonce keeps counting. Both parties must rekey the
+matching direction at the same point of the message stream; when that happens is up to the
+application protocol.
+
+```
+initiator.rekey_encryption
+responder.rekey_decryption
+```
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/lib/noise/connection/base.rb

@@ -3,13 +3,26 @@
 module Noise
   module Connection
     class Base
-      # The Noise spec caps a handshake or transport message at 65535 bytes.
+      # The Noise spec caps a handshake or transport message at 65535 bytes. A transport message is
+      # the ciphertext, so the plaintext a caller may hand to encrypt is shorter by the
+      # authentication tag that ENCRYPT() appends.
       MAX_MESSAGE_LENGTH = 65_535
+      MAX_PLAINTEXT_LENGTH = MAX_MESSAGE_LENGTH - Noise::State::CipherState::TAG_LENGTH
 
       attr_reader :protocol, :handshake_started, :handshake_finished, :handshake_hash, :handshake_state,
                   :cipher_state_encrypt, :cipher_state_decrypt, :cipher_state_handshake, :s, :rs
       attr_accessor :psks, :prologue
 
+      # @param [String] name the protocol name, for example 'Noise_XX_25519_ChaChaPoly_SHA256'.
+      # @param [Hash] keypairs the keys the pattern needs, as private or public key strings.
+      #   :s is the local static private key, :rs and :re the remote static and ephemeral public keys.
+      #
+      #   :e sets the local ephemeral private key. It exists only so that spec/vectors_spec.rb can
+      #   reproduce the official test vectors, which fix both sides' ephemeral keys to make the
+      #   output deterministic. Never set it outside that use: HandshakeState#write_message reuses
+      #   the keypair given here instead of generating a fresh one, and an ephemeral key reused
+      #   across handshakes gives up the forward secrecy every pattern depends on. The handshake
+      #   still succeeds, so nothing reports the loss.
       def initialize(name, keypairs: { s: nil, e: nil, rs: nil, re: nil })
         @protocol = Protocol.create(name)
 
@@ -61,8 +74,10 @@ module Noise
         raise Noise::Exceptions::NoiseHandshakeError if @next_message != :write
         raise Noise::Exceptions::NoiseHandshakeError if @handshake_finished
 
-        if @handshake_state.expected_message_length(payload.bytesize) > MAX_MESSAGE_LENGTH
-          raise Noise::Exceptions::NoiseHandshakeError, 'Message exceeds the maximum length.'
+        length = @handshake_state.expected_message_length(payload.bytesize)
+        if length > MAX_MESSAGE_LENGTH
+          raise Noise::Exceptions::MessageTooLongError,
+                "Message would be #{length} bytes, which exceeds the maximum of #{MAX_MESSAGE_LENGTH}."
         end
 
         @next_message = :read
@@ -76,8 +91,11 @@ module Noise
         raise Noise::Exceptions::NoiseHandshakeError unless @handshake_started
         raise Noise::Exceptions::NoiseHandshakeError if @next_message != :read
         raise Noise::Exceptions::NoiseHandshakeError if @handshake_finished
-        raise Noise::Exceptions::NoiseHandshakeError, 'Message exceeds the maximum length.' if
-          data.bytesize > MAX_MESSAGE_LENGTH
+
+        if data.bytesize > MAX_MESSAGE_LENGTH
+          raise Noise::Exceptions::MessageTooLongError,
+                "Message is #{data.bytesize} bytes, which exceeds the maximum of #{MAX_MESSAGE_LENGTH}."
+        end
 
         @next_message = :write
         buffer = +''
@@ -86,21 +104,82 @@ module Noise
       end
 
       def encrypt(data)
-        raise Noise::Exceptions::NoiseHandshakeError unless @handshake_finished
+        cipher_state = transport_cipher_state(:encrypt)
+        if data.bytesize > MAX_PLAINTEXT_LENGTH
+          raise Noise::Exceptions::MessageTooLongError,
+                "Plaintext is #{data.bytesize} bytes, which exceeds the maximum of #{MAX_PLAINTEXT_LENGTH}."
+        end
 
-        @cipher_state_encrypt.encrypt_with_ad('', data)
+        cipher_state.encrypt_with_ad('', data)
       end
 
       def decrypt(data)
-        raise Noise::Exceptions::NoiseHandshakeError unless @handshake_finished
+        cipher_state = transport_cipher_state(:decrypt)
+        # Rejected before the cipher state is used, so an over-long message leaves n untouched
+        # and the connection usable, exactly as a failed decryption does.
+        if data.bytesize > MAX_MESSAGE_LENGTH
+          raise Noise::Exceptions::MessageTooLongError,
+                "Message is #{data.bytesize} bytes, which exceeds the maximum of #{MAX_MESSAGE_LENGTH}."
+        end
+
+        cipher_state.decrypt_with_ad('', data)
+      end
 
-        @cipher_state_decrypt.decrypt_with_ad('', data)
+      # @return [Integer] the nonce the next #encrypt call uses.
+      def encryption_nonce
+        transport_cipher_state(:encrypt).n
+      end
+
+      # @return [Integer] the nonce the next #decrypt call uses.
+      def decryption_nonce
+        transport_cipher_state(:decrypt).n
+      end
+
+      # Sets the nonce of the next #encrypt call. Needed when the transport layer numbers the
+      # messages itself instead of relying on the sender and the receiver counting in step.
+      #
+      # @param [Integer] nonce a value between 0 and CipherState::MAX_NONCE.
+      def encryption_nonce=(nonce)
+        transport_cipher_state(:encrypt).nonce = nonce
+      end
+
+      # Sets the nonce of the next #decrypt call. This is how the Noise spec handles transport
+      # messages that arrive out of order: the receiver sets n to the nonce of the message it is
+      # about to decrypt, and restores the previous value if the message fails to authenticate.
+      #
+      # @param [Integer] nonce a value between 0 and CipherState::MAX_NONCE.
+      def decryption_nonce=(nonce)
+        transport_cipher_state(:decrypt).nonce = nonce
+      end
+
+      # Replaces the key used by #encrypt with REKEY(k), so that the old key cannot decrypt the
+      # messages that follow. Both parties must rekey the matching direction at the same point of
+      # the message stream, which is up to the application protocol to agree on.
+      #
+      # @return [void]
+      def rekey_encryption
+        transport_cipher_state(:encrypt).rekey
+        nil
+      end
+
+      # Replaces the key used by #decrypt with REKEY(k). See #rekey_encryption.
+      #
+      # @return [void]
+      def rekey_decryption
+        transport_cipher_state(:decrypt).rekey
+        nil
       end
 
       def validate_psk!
+        raise Noise::Exceptions::NoisePSKError, 'psks are not set.' if @psks.nil?
         # Invalid psk length! Has to be 32 bytes long
-        raise Noise::Exceptions::NoisePSKError if @psks.any? { |psk| psk.bytesize != 32 }
-        raise Noise::Exceptions::NoisePSKError if @protocol.pattern.psk_count != @psks.count
+        raise Noise::Exceptions::NoisePSKError, 'psks have to be 32 bytes long.' if
+          @psks.any? { |psk| psk.bytesize != 32 }
+
+        return if @protocol.pattern.psk_count == @psks.count
+
+        raise Noise::Exceptions::NoisePSKError,
+              "This protocol needs #{@protocol.pattern.psk_count} psks, got #{@psks.count}."
       end
 
       def missing_keypairs?
@@ -124,6 +203,23 @@ module Noise
         @symmetric_state = nil
         @cipher_state_handshake = nil
       end
+
+      private
+
+      # Returns the transport CipherState of the given direction.
+      #
+      # One-way patterns leave the direction the caller cannot use as nil, so the absence of a
+      # cipher state is reported the same way as a handshake that has not finished yet.
+      #
+      # @param [Symbol] direction :encrypt or :decrypt.
+      def transport_cipher_state(direction)
+        raise Noise::Exceptions::NoiseHandshakeError unless @handshake_finished
+
+        cipher_state = direction == :encrypt ? @cipher_state_encrypt : @cipher_state_decrypt
+        raise Noise::Exceptions::NoiseHandshakeError, "This party cannot #{direction} messages." unless cipher_state
+
+        cipher_state
+      end
     end
   end
 end

data/lib/noise/exceptions/invalid_nonce_error.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Noise
+  module Exceptions
+    # Raised when a nonce given to CipherState#nonce= is not an unsigned 64-bit integer.
+    class InvalidNonceError < RuntimeError
+    end
+  end
+end

data/lib/noise/exceptions/message_too_long_error.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Noise
+  module Exceptions
+    # Raised when a message would exceed, or does exceed, the 65535 byte limit the Noise
+    # specification places on every message. Raised from the handshake and the transport paths
+    # alike, so that a caller handling "the peer sent something too long" rescues one class rather
+    # than one per phase.
+    #
+    # It covers over-long messages only, and the other framing errors keep their own classes: a
+    # truncated handshake message raises NoiseHandshakeError, and a transport message shorter than
+    # the authentication tag raises DecryptError. A caller that treats every framing error alike
+    # has to rescue all three.
+    #
+    # Kept apart from DecryptError so that a badly framed message can be told from a failed
+    # authentication, which has very different security meaning.
+    class MessageTooLongError < StandardError
+    end
+  end
+end

data/lib/noise/exceptions.rb

@@ -4,8 +4,10 @@ module Noise
   module Exceptions
     autoload :DecryptError, 'noise/exceptions/decrypt_error'
     autoload :EncryptError, 'noise/exceptions/encrypt_error'
+    autoload :InvalidNonceError, 'noise/exceptions/invalid_nonce_error'
     autoload :InvalidPublicKeyError, 'noise/exceptions/invalid_public_key_error'
     autoload :MaxNonceError, 'noise/exceptions/max_nonce_error'
+    autoload :MessageTooLongError, 'noise/exceptions/message_too_long_error'
     autoload :MissingDependencyError, 'noise/exceptions/missing_dependency_error'
     autoload :ProtocolNameError, 'noise/exceptions/protocol_name_error'
     autoload :NoiseHandshakeError, 'noise/exceptions/noise_handshake_error'

data/lib/noise/functions/dh/ed25519.rb

@@ -12,8 +12,20 @@ module Noise
           Noise::Key.new(ECDSA::Format::IntegerOctetString.encode(private_key, 32), public_key.to_bytes)
         end
 
+        # Computes the X25519 shared secret for the given remote public key.
+        #
+        # RbNaCl reports a public key it cannot use in two different ways: a wrong length
+        # raises RbNaCl::LengthError, and an all-zero or low-order point raises
+        # RbNaCl::CryptoError. Both are translated to InvalidPublicKeyError so that a
+        # caller handling a peer-supplied key rescues the same class for every DH function.
+        # The length is checked before the call so that RbNaCl::LengthError raised for a
+        # malformed private key keeps propagating as itself.
         def dh(private_key, public_key)
+          raise Noise::Exceptions::InvalidPublicKeyError, public_key unless public_key.bytesize == DHLEN
+
           RbNaCl::GroupElement.new(public_key).mult(private_key).to_bytes
+        rescue RbNaCl::CryptoError
+          raise Noise::Exceptions::InvalidPublicKeyError, public_key
         end
 
         def dhlen

data/lib/noise/functions/dh/ed448.rb

@@ -1,26 +1,43 @@
 # frozen_string_literal: true
 
-Noise.require_optional('ed448') { Ed448.init }
-
 module Noise
   module Functions
     module DH
+      # The 448 DH function of the Noise specification, which is X448 as defined by RFC 7748 and
+      # not the Ed448 signature scheme the class name suggests. The name is kept because it is what
+      # Protocol::DH maps '448' to and what callers reference.
+      #
+      # OpenSSL implements X448 and exposes it through the raw key interface, so this function needs
+      # no gem and no system library beyond the OpenSSL that AesGcm and the HMAC helpers already use.
       class ED448
-        # Ed448::X448::X448_PRIVATE_BYTES, spelled out so this file loads without the gem.
         DHLEN = 56
 
-        def initialize
-          Noise.optional_dependency!('ed448')
-        end
+        # The name OpenSSL knows the curve by. Ed448 is a different algorithm, and asking for it
+        # here would produce a signing key rather than one that can derive a shared secret.
+        ALGORITHM = 'X448'
 
         def generate_keypair
-          private_key = SecureRandom.random_bytes(DHLEN)
-          public_key = Ed448::X448.derive_public_key(private_key)
-          Noise::Key.new(private_key, public_key)
+          pkey = OpenSSL::PKey.generate_key(ALGORITHM)
+          Noise::Key.new(pkey.raw_private_key, pkey.raw_public_key)
         end
 
+        # Computes the X448 shared secret for the given remote public key.
+        #
+        # OpenSSL reports a public key it cannot use as OpenSSL::PKey::PKeyError, both when the key
+        # is not DHLEN bytes and when the derivation would produce the all-zero output that RFC 7748
+        # requires be rejected. Both are translated to InvalidPublicKeyError so that a caller
+        # handling a peer-supplied key rescues the same class for every DH function. The local key
+        # is built outside the rescue so that a malformed private key keeps propagating as
+        # PKeyError instead of being reported as the peer's fault.
         def dh(private_key, public_key)
-          Ed448::X448.dh(public_key, private_key)
+          raise Noise::Exceptions::InvalidPublicKeyError, public_key unless public_key.bytesize == DHLEN
+
+          local = OpenSSL::PKey.new_raw_private_key(ALGORITHM, private_key)
+          begin
+            local.derive(OpenSSL::PKey.new_raw_public_key(ALGORITHM, public_key))
+          rescue OpenSSL::PKey::PKeyError
+            raise Noise::Exceptions::InvalidPublicKeyError, public_key
+          end
         end
 
         def dhlen
@@ -28,8 +45,8 @@ module Noise
         end
 
         def self.from_private(private_key)
-          public_key = Ed448::X448.derive_public_key(private_key)
-          Noise::Key.new(private_key, public_key)
+          pkey = OpenSSL::PKey.new_raw_private_key(ALGORITHM, private_key)
+          Noise::Key.new(private_key, pkey.raw_public_key)
         end
       end
     end

data/lib/noise/functions/dh/secp256k1.rb

@@ -1,13 +1,35 @@
 # frozen_string_literal: true
 
-Noise.require_optional 'secp256k1'
-
 module Noise
   module Functions
     module DH
+      # The secp256k1 DH function, as the Lightning Network uses it in BOLT #8.
+      #
+      # The shared secret is SHA256 of the shared point in compressed form, not the raw X
+      # coordinate. That is what BOLT #8 specifies and what libsecp256k1's ecdh returned when this
+      # function was backed by that library, so the value on the wire is unchanged.
       class Secp256k1
+        # Length of a compressed secp256k1 point. The 65-byte uncompressed form encodes the same
+        # point, but Noise exchanges only the compressed one, so it is rejected.
+        DHLEN = 33
+
+        # Length of a secp256k1 scalar, which is what a private key is.
+        PRIVATE_KEY_LEN = 32
+
+        # The name OpenSSL knows the curve by.
+        CURVE = 'secp256k1'
+
+        # Builds the curve group once, because dh needs it on every call.
+        #
+        # secp256k1 is a builtin curve of OpenSSL 3, but an OpenSSL restricted to a FIPS provider
+        # does not offer it. That leaves the function unusable in the same way a missing system
+        # library did, so it is reported as MissingDependencyError rather than as an OpenSSL error
+        # raised in the middle of a handshake.
         def initialize
-          Noise.optional_dependency!('secp256k1')
+          @group = OpenSSL::PKey::EC::Group.new(CURVE)
+        rescue OpenSSL::PKey::EC::Group::Error => e
+          raise Noise::Exceptions::MissingDependencyError,
+                "OpenSSL does not offer the #{CURVE} curve: #{e.message}"
         end
 
         def generate_keypair
@@ -15,28 +37,78 @@ module Noise
           private_key = 1 + SecureRandom.random_number(group.order - 1)
           public_key = group.generator.multiply_by_scalar(private_key)
           Noise::Key.new(
-            ECDSA::Format::IntegerOctetString.encode(private_key, 32),
+            ECDSA::Format::IntegerOctetString.encode(private_key, PRIVATE_KEY_LEN),
             ECDSA::Format::PointOctetString.encode(public_key, compression: true)
           )
         end
 
+        # Computes the ECDH shared secret for the given remote public key.
+        #
+        # Every way a peer-supplied key can be unusable raises InvalidPublicKeyError, matching the
+        # other DH functions: a length other than DHLEN, and an encoding that names no point on the
+        # curve. A private key the caller owns is not the peer's fault, so a malformed one raises
+        # ArgumentError instead, as it did when the gem parsed it.
         def dh(private_key, public_key)
-          key = ::Secp256k1::PublicKey.new(pubkey: public_key, raw: true)
-          key.ecdh(private_key)
-        rescue ::Secp256k1::AssertError
-          raise Noise::Exceptions::InvalidPublicKeyError, public_key
+          raise Noise::Exceptions::InvalidPublicKeyError, public_key unless public_key.bytesize == DHLEN
+
+          scalar = OpenSSL::BN.new(self.class.decode_private_key(private_key))
+          shared = parse_public_key(public_key).mul(scalar)
+          # A backstop rather than a reachable case: secp256k1 has cofactor 1, so a point that
+          # parsed has order n, and the scalar is already known to be in [1, n-1]. It stays because
+          # the cost is one comparison and the failure it guards is severe - the compressed
+          # encoding of infinity is the single byte 0x00, whose SHA256 anyone can precompute.
+          raise Noise::Exceptions::InvalidPublicKeyError, public_key if shared.infinity?
+
+          OpenSSL::Digest.digest('SHA256', shared.to_octet_string(:compressed))
         end
 
         def dhlen
-          33
+          DHLEN
         end
 
         def self.from_private(private_key)
-          group = ECDSA::Group::Secp256k1
-          scalar = ECDSA::Format::IntegerOctetString.decode(private_key)
-          point = group.generator.multiply_by_scalar(scalar)
+          scalar = decode_private_key(private_key)
+          point = ECDSA::Group::Secp256k1.generator.multiply_by_scalar(scalar)
           Noise::Key.new(private_key, ECDSA::Format::PointOctetString.encode(point, compression: true))
         end
+
+        # Decodes a private key into the scalar it denotes, rejecting the values that cannot serve
+        # as one. Both entry points that take a private key go through this, so a key from_private
+        # accepts is one dh can use.
+        #
+        # Rejected are a length other than PRIVATE_KEY_LEN, zero, and anything at or above the
+        # group order: those scalars multiply every point to infinity, whose compressed encoding is
+        # the single byte 0x00. Without the check from_private would hand back a Noise::Key holding
+        # that one byte as its public key, and the handshake it is used in would fail only once the
+        # key reached the wire. A private key belongs to the caller rather than to the peer, so a
+        # bad one raises ArgumentError and not InvalidPublicKeyError.
+        def self.decode_private_key(private_key)
+          unless private_key.bytesize == PRIVATE_KEY_LEN
+            raise ArgumentError, "private key must be #{PRIVATE_KEY_LEN} bytes"
+          end
+
+          scalar = ECDSA::Format::IntegerOctetString.decode(private_key)
+          order = ECDSA::Group::Secp256k1.order
+          raise ArgumentError, 'private key is out of range' unless scalar.between?(1, order - 1)
+
+          scalar
+        end
+
+        private
+
+        # Decodes a public key into a point on the curve.
+        #
+        # The key is passed as a String, not as an OpenSSL::BN. OpenSSL then decodes it as an octet
+        # string and raises Point::Error for anything that is not a point on the curve, the
+        # all-zero key included: 0x00 introduces the encoding of infinity, which is one byte long,
+        # so 33 zero bytes are rejected as a malformed encoding. Handing over a BN instead would
+        # drop the leading zero byte and produce the point at infinity, whose shared secret is a
+        # constant that the sender of such a key could precompute.
+        def parse_public_key(public_key)
+          OpenSSL::PKey::EC::Point.new(@group, public_key)
+        rescue OpenSSL::PKey::EC::Point::Error
+          raise Noise::Exceptions::InvalidPublicKeyError, public_key
+        end
       end
     end
   end

data/lib/noise/state/cipher_state.rb

@@ -29,7 +29,17 @@ module Noise
         !@k.nil?
       end
 
+      # Sets n, the nonce the next encrypt_with_ad or decrypt_with_ad call uses. This is SetNonce()
+      # of the Noise spec, needed to decrypt transport messages that arrive out of order.
+      #
+      # The value is checked here because the ciphers pack n into 8 bytes: a value outside the
+      # unsigned 64-bit range silently produces a wrong nonce instead of an error.
+      #
+      # @param [Integer] nonce a value between 0 and MAX_NONCE.
+      # @raise [Noise::Exceptions::InvalidNonceError] if nonce is out of that range.
       def nonce=(nonce)
+        raise Noise::Exceptions::InvalidNonceError unless nonce.is_a?(Integer) && nonce.between?(0, MAX_NONCE)
+
         @n = nonce
       end
 
@@ -56,6 +66,9 @@ module Noise
         plaintext
       end
 
+      # Replaces k with REKEY(k). n is left as it is, as the Noise spec requires.
+      #
+      # @return [String] the new 32 bytes key.
       def rekey
         @k = @cipher.rekey(@k)
       end

data/lib/noise/state/handshake_state.rb

@@ -107,6 +107,12 @@ module Noise
         pattern.each do |token|
           case token
           when Noise::Token::E
+            # A fresh keypair per handshake is what the pattern's forward secrecy rests on. Two
+            # things preset @e. Connection::Base#fallback carries the ephemeral of the aborted
+            # handshake into the new state, which the fallback patterns require: process_fallback
+            # mixes its public key as a pre-message. A caller passing keypairs[:e] to
+            # Connection::Base#initialize also presets it, and that is supported for reproducing
+            # the official test vectors and nothing else.
             @e ||= @protocol.dh_fn.generate_keypair
             message_buffer << @e.public_key
             mix_e(@e.public_key)

data/lib/noise/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Noise
-  VERSION = '0.11.0'
+  VERSION = '0.13.0'
 end

data/lib/noise.rb

@@ -3,7 +3,7 @@
 require 'noise/version'
 
 require 'ecdsa'
-require 'logger'
+require 'openssl'
 require 'rbnacl'
 require 'ruby_hmac'
 require 'securerandom'
@@ -26,18 +26,25 @@ module Noise
   @unavailable_dependencies = {}
 
   class << self
-    def logger
-      @logger ||= Logger.new($stdout)
-    end
-
+    # Requires an optional backend gem and yields once it is loaded. A LoadError is not fatal:
+    # the reason is recorded so optional_dependency! can raise it later, and a warning goes to
+    # $stderr so the missing backend is visible at load time. Kernel#warn is used rather than a
+    # Logger because logger is no longer a default gem on Ruby 4.0, and this single message does
+    # not justify a runtime dependency on it.
     def require_optional(name)
       require name
-      yield if block_given?
     rescue LoadError => e
       @unavailable_dependencies[name] = e.message
-      logger.warn("Optional dependency '#{name}' is unavailable: #{e.message}")
+      warn("Optional dependency '#{name}' is unavailable: #{e.message}")
+    else
+      # The block runs outside the rescue on purpose: a LoadError raised by the block itself is
+      # about something other than this dependency, and swallowing it here would hide the cause.
+      yield if block_given?
     end
 
+    # Raises MissingDependencyError if the named optional backend failed to load earlier. Call it
+    # from the entry point of a function that needs the backend, so the failure surfaces where the
+    # backend is used rather than at require time.
     def optional_dependency!(name)
       reason = @unavailable_dependencies[name]
       return if reason.nil?

data/noise.gemspec

@@ -6,7 +6,7 @@ require 'noise/version'
 
 Gem::Specification.new do |spec|
   spec.name = 'noise-ruby'
-  spec.required_ruby_version = '~> 3.0'
+  spec.required_ruby_version = '>= 3.2'
   spec.version       = Noise::VERSION
   spec.authors       = ['Hajime Yamaguchi']
   spec.email         = ['gen.yamaguchi0@gmail.com']
@@ -22,7 +22,6 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.add_development_dependency 'bundler', '~> 2.0'
   spec.add_development_dependency 'rake', '>= 12.3.3'
   spec.add_development_dependency 'rspec', '~> 3.0'
 
@@ -31,14 +30,17 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'simplecov'
   spec.add_development_dependency 'simplecov-json'
 
-  # Optional backends. Each one is needed only when its function appears in a protocol name, and
-  # each also needs a system library that cannot be installed as a gem, so none of them is a runtime
-  # dependency. Add the one you need to your own Gemfile; see the README for the system libraries.
+  # Optional backend. BLAKE3 is needed only when it appears in a protocol name, and it needs Rust
+  # to build, so it is not a runtime dependency. Add it to your own Gemfile if you need it; see the
+  # README.
   spec.add_development_dependency 'blake3'
-  spec.add_development_dependency 'ed448'
-  spec.add_development_dependency 'secp256k1-ruby'
 
   spec.add_runtime_dependency 'ecdsa'
+  # The 448 DH function needs the raw key API (OpenSSL::PKey.new_raw_private_key and friends),
+  # which arrived in openssl 3.0. Every supported interpreter bundles a newer default gem, but the
+  # floor is stated so an older openssl pinned in an application's Gemfile fails to resolve rather
+  # than failing at runtime.
+  spec.add_runtime_dependency 'openssl', '>= 3.0'
   spec.add_runtime_dependency 'rbnacl'
   spec.add_runtime_dependency 'ruby-hmac'
 end

metadata

@@ -1,29 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: noise-ruby
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.13.0
 platform: ruby
 authors:
 - Hajime Yamaguchi
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-31 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: bundler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -123,27 +108,13 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: ed448
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: secp256k1-ruby
+  name: ecdsa
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-  type: :development
+  type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
@@ -151,19 +122,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: ecdsa
+  name: openssl
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: rbnacl
   requirement: !ruby/object:Gem::Requirement
@@ -220,8 +191,10 @@ files:
 - lib/noise/exceptions.rb
 - lib/noise/exceptions/decrypt_error.rb
 - lib/noise/exceptions/encrypt_error.rb
+- lib/noise/exceptions/invalid_nonce_error.rb
 - lib/noise/exceptions/invalid_public_key_error.rb
 - lib/noise/exceptions/max_nonce_error.rb
+- lib/noise/exceptions/message_too_long_error.rb
 - lib/noise/exceptions/missing_dependency_error.rb
 - lib/noise/exceptions/noise_handshake_error.rb
 - lib/noise/exceptions/noise_psk_error.rb
@@ -257,23 +230,21 @@ files:
 homepage: https://github.com/Yamaguchi/noise
 licenses: []
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - "~>"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: '3.0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
-signing_key:
+rubygems_version: 4.0.16
 specification_version: 4
 summary: A Ruby implementation of the Noise Protocol framework
 test_files: []