librats 1.0.2 → 2.2.0

package/native-src/src/librats/crypto/hkdf.c

@@ -0,0 +1,266 @@
+/*
+ * HKDF-SHA256 implementation for Noise Protocol
+ * Based on RFC 5869
+ */
+
+#include "librats/crypto/hkdf.h"
+#include "librats/crypto/sha256.h"
+#include <string.h>
+
+#define RATS_SHA256_BLOCK_SIZE 64
+#define RATS_SHA256_HASH_SIZE 32
+
+/* Zero memory securely */
+static void secure_zero(void *ptr, size_t len) {
+    volatile uint8_t *p = (volatile uint8_t *)ptr;
+    while (len--) {
+        *p++ = 0;
+    }
+}
+
+void rats_hmac_sha256(
+    const uint8_t *key, size_t key_len,
+    const uint8_t *data, size_t data_len,
+    uint8_t output[RATS_HKDF_SHA256_HASH_LEN]
+) {
+    rats_sha256_context_t ctx;
+    uint8_t k_pad[RATS_SHA256_BLOCK_SIZE];
+    uint8_t temp_key[RATS_SHA256_HASH_SIZE];
+    const uint8_t *k;
+    size_t k_len;
+    size_t i;
+    
+    /* If key is longer than block size, hash it first */
+    if (key_len > RATS_SHA256_BLOCK_SIZE) {
+        rats_sha256_hash(temp_key, key, key_len);
+        k = temp_key;
+        k_len = RATS_SHA256_HASH_SIZE;
+    } else {
+        k = key;
+        k_len = key_len;
+    }
+    
+    /* Prepare inner padding (key XOR 0x36) */
+    memset(k_pad, 0x36, RATS_SHA256_BLOCK_SIZE);
+    for (i = 0; i < k_len; i++) {
+        k_pad[i] ^= k[i];
+    }
+    
+    /* Inner hash: H(K XOR ipad || data) */
+    rats_sha256_reset(&ctx);
+    rats_sha256_update(&ctx, k_pad, RATS_SHA256_BLOCK_SIZE);
+    rats_sha256_update(&ctx, data, data_len);
+    rats_sha256_finish(&ctx, output);
+    
+    /* Prepare outer padding (key XOR 0x5c) */
+    memset(k_pad, 0x5c, RATS_SHA256_BLOCK_SIZE);
+    for (i = 0; i < k_len; i++) {
+        k_pad[i] ^= k[i];
+    }
+    
+    /* Outer hash: H(K XOR opad || inner_hash) */
+    rats_sha256_reset(&ctx);
+    rats_sha256_update(&ctx, k_pad, RATS_SHA256_BLOCK_SIZE);
+    rats_sha256_update(&ctx, output, RATS_SHA256_HASH_SIZE);
+    rats_sha256_finish(&ctx, output);
+    
+    /* Clean up */
+    secure_zero(k_pad, sizeof(k_pad));
+    secure_zero(temp_key, sizeof(temp_key));
+}
+
+void rats_hmac_sha256_2(
+    const uint8_t *key, size_t key_len,
+    const uint8_t *data1, size_t data1_len,
+    const uint8_t *data2, size_t data2_len,
+    uint8_t output[RATS_HKDF_SHA256_HASH_LEN]
+) {
+    rats_sha256_context_t ctx;
+    uint8_t k_pad[RATS_SHA256_BLOCK_SIZE];
+    uint8_t temp_key[RATS_SHA256_HASH_SIZE];
+    const uint8_t *k;
+    size_t k_len;
+    size_t i;
+    
+    /* If key is longer than block size, hash it first */
+    if (key_len > RATS_SHA256_BLOCK_SIZE) {
+        rats_sha256_hash(temp_key, key, key_len);
+        k = temp_key;
+        k_len = RATS_SHA256_HASH_SIZE;
+    } else {
+        k = key;
+        k_len = key_len;
+    }
+    
+    /* Prepare inner padding (key XOR 0x36) */
+    memset(k_pad, 0x36, RATS_SHA256_BLOCK_SIZE);
+    for (i = 0; i < k_len; i++) {
+        k_pad[i] ^= k[i];
+    }
+    
+    /* Inner hash: H(K XOR ipad || data1 || data2) */
+    rats_sha256_reset(&ctx);
+    rats_sha256_update(&ctx, k_pad, RATS_SHA256_BLOCK_SIZE);
+    rats_sha256_update(&ctx, data1, data1_len);
+    rats_sha256_update(&ctx, data2, data2_len);
+    rats_sha256_finish(&ctx, output);
+    
+    /* Prepare outer padding (key XOR 0x5c) */
+    memset(k_pad, 0x5c, RATS_SHA256_BLOCK_SIZE);
+    for (i = 0; i < k_len; i++) {
+        k_pad[i] ^= k[i];
+    }
+    
+    /* Outer hash: H(K XOR opad || inner_hash) */
+    rats_sha256_reset(&ctx);
+    rats_sha256_update(&ctx, k_pad, RATS_SHA256_BLOCK_SIZE);
+    rats_sha256_update(&ctx, output, RATS_SHA256_HASH_SIZE);
+    rats_sha256_finish(&ctx, output);
+    
+    /* Clean up */
+    secure_zero(k_pad, sizeof(k_pad));
+    secure_zero(temp_key, sizeof(temp_key));
+}
+
+void rats_hkdf_sha256_extract(
+    const uint8_t *salt, size_t salt_len,
+    const uint8_t *ikm, size_t ikm_len,
+    uint8_t prk[RATS_HKDF_SHA256_HASH_LEN]
+) {
+    static const uint8_t default_salt[RATS_HKDF_SHA256_HASH_LEN] = {0};
+    
+    if (salt == NULL || salt_len == 0) {
+        salt = default_salt;
+        salt_len = RATS_HKDF_SHA256_HASH_LEN;
+    }
+    
+    rats_hmac_sha256(salt, salt_len, ikm, ikm_len, prk);
+}
+
+void rats_hkdf_sha256_expand(
+    const uint8_t prk[RATS_HKDF_SHA256_HASH_LEN],
+    const uint8_t *info, size_t info_len,
+    uint8_t *okm, size_t okm_len
+) {
+    rats_sha256_context_t ctx;
+    uint8_t k_pad[RATS_SHA256_BLOCK_SIZE];
+    uint8_t T[RATS_SHA256_HASH_SIZE];
+    uint8_t counter;
+    size_t t_len = 0;
+    size_t copy_len;
+    size_t i;
+    
+    /* Key is always 32 bytes (hash length) */
+    /* Prepare inner padding template */
+    memset(k_pad, 0x36, RATS_SHA256_BLOCK_SIZE);
+    for (i = 0; i < RATS_HKDF_SHA256_HASH_LEN; i++) {
+        k_pad[i] ^= prk[i];
+    }
+    
+    counter = 1;
+    while (okm_len > 0) {
+        uint8_t outer_result[RATS_SHA256_HASH_SIZE];
+        uint8_t k_pad_outer[RATS_SHA256_BLOCK_SIZE];
+        
+        /* Inner hash: H(K XOR ipad || T || info || counter) */
+        rats_sha256_reset(&ctx);
+        rats_sha256_update(&ctx, k_pad, RATS_SHA256_BLOCK_SIZE);
+        if (t_len > 0) {
+            rats_sha256_update(&ctx, T, t_len);
+        }
+        if (info_len > 0) {
+            rats_sha256_update(&ctx, info, info_len);
+        }
+        rats_sha256_update(&ctx, &counter, 1);
+        rats_sha256_finish(&ctx, T);
+        
+        /* Prepare outer padding */
+        memset(k_pad_outer, 0x5c, RATS_SHA256_BLOCK_SIZE);
+        for (i = 0; i < RATS_HKDF_SHA256_HASH_LEN; i++) {
+            k_pad_outer[i] ^= prk[i];
+        }
+        
+        /* Outer hash: H(K XOR opad || inner_hash) */
+        rats_sha256_reset(&ctx);
+        rats_sha256_update(&ctx, k_pad_outer, RATS_SHA256_BLOCK_SIZE);
+        rats_sha256_update(&ctx, T, RATS_SHA256_HASH_SIZE);
+        rats_sha256_finish(&ctx, T);
+        
+        /* Copy to output */
+        copy_len = okm_len < RATS_SHA256_HASH_SIZE ? okm_len : RATS_SHA256_HASH_SIZE;
+        memcpy(okm, T, copy_len);
+        okm += copy_len;
+        okm_len -= copy_len;
+        
+        t_len = RATS_SHA256_HASH_SIZE;
+        counter++;
+        
+        secure_zero(k_pad_outer, sizeof(k_pad_outer));
+    }
+    
+    secure_zero(k_pad, sizeof(k_pad));
+    secure_zero(T, sizeof(T));
+}
+
+void rats_hkdf_sha256(
+    const uint8_t *salt, size_t salt_len,
+    const uint8_t *ikm, size_t ikm_len,
+    const uint8_t *info, size_t info_len,
+    uint8_t *okm, size_t okm_len
+) {
+    uint8_t prk[RATS_HKDF_SHA256_HASH_LEN];
+    
+    rats_hkdf_sha256_extract(salt, salt_len, ikm, ikm_len, prk);
+    rats_hkdf_sha256_expand(prk, info, info_len, okm, okm_len);
+    
+    secure_zero(prk, sizeof(prk));
+}
+
+void rats_noise_hkdf_2(
+    const uint8_t chaining_key[RATS_HKDF_SHA256_HASH_LEN],
+    const uint8_t *input_key, size_t input_len,
+    uint8_t output1[RATS_HKDF_SHA256_HASH_LEN],
+    uint8_t output2[RATS_HKDF_SHA256_HASH_LEN]
+) {
+    uint8_t temp_key[RATS_HKDF_SHA256_HASH_LEN];
+    uint8_t counter1 = 0x01;
+    uint8_t counter2 = 0x02;
+    
+    /* temp_key = HMAC(ck, input) */
+    rats_hmac_sha256(chaining_key, RATS_HKDF_SHA256_HASH_LEN, input_key, input_len, temp_key);
+    
+    /* output1 = HMAC(temp_key, 0x01) */
+    rats_hmac_sha256(temp_key, RATS_HKDF_SHA256_HASH_LEN, &counter1, 1, output1);
+    
+    /* output2 = HMAC(temp_key, output1 || 0x02) */
+    rats_hmac_sha256_2(temp_key, RATS_HKDF_SHA256_HASH_LEN, output1, RATS_HKDF_SHA256_HASH_LEN, &counter2, 1, output2);
+    
+    secure_zero(temp_key, sizeof(temp_key));
+}
+
+void rats_noise_hkdf_3(
+    const uint8_t chaining_key[RATS_HKDF_SHA256_HASH_LEN],
+    const uint8_t *input_key, size_t input_len,
+    uint8_t output1[RATS_HKDF_SHA256_HASH_LEN],
+    uint8_t output2[RATS_HKDF_SHA256_HASH_LEN],
+    uint8_t output3[RATS_HKDF_SHA256_HASH_LEN]
+) {
+    uint8_t temp_key[RATS_HKDF_SHA256_HASH_LEN];
+    uint8_t counter1 = 0x01;
+    uint8_t counter2 = 0x02;
+    uint8_t counter3 = 0x03;
+    
+    /* temp_key = HMAC(ck, input) */
+    rats_hmac_sha256(chaining_key, RATS_HKDF_SHA256_HASH_LEN, input_key, input_len, temp_key);
+    
+    /* output1 = HMAC(temp_key, 0x01) */
+    rats_hmac_sha256(temp_key, RATS_HKDF_SHA256_HASH_LEN, &counter1, 1, output1);
+    
+    /* output2 = HMAC(temp_key, output1 || 0x02) */
+    rats_hmac_sha256_2(temp_key, RATS_HKDF_SHA256_HASH_LEN, output1, RATS_HKDF_SHA256_HASH_LEN, &counter2, 1, output2);
+    
+    /* output3 = HMAC(temp_key, output2 || 0x03) */
+    rats_hmac_sha256_2(temp_key, RATS_HKDF_SHA256_HASH_LEN, output2, RATS_HKDF_SHA256_HASH_LEN, &counter3, 1, output3);
+    
+    secure_zero(temp_key, sizeof(temp_key));
+}

package/native-src/src/{crypto → librats/crypto}/hkdf.h

@@ -13,7 +13,7 @@
 extern "C" {
 #endif
 
-#define HKDF_SHA256_HASH_LEN 32
+#define RATS_HKDF_SHA256_HASH_LEN 32
 
 /**
  * HMAC-SHA256 function
@@ -24,10 +24,10 @@ extern "C" {
  * @param data_len Length of data
  * @param output   Output buffer (32 bytes)
  */
-void hmac_sha256(
+void rats_hmac_sha256(
     const uint8_t *key, size_t key_len,
     const uint8_t *data, size_t data_len,
-    uint8_t output[HKDF_SHA256_HASH_LEN]
+    uint8_t output[RATS_HKDF_SHA256_HASH_LEN]
 );
 
 /**
@@ -41,11 +41,11 @@ void hmac_sha256(
  * @param data2_len Length of second data block
  * @param output    Output buffer (32 bytes)
  */
-void hmac_sha256_2(
+void rats_hmac_sha256_2(
     const uint8_t *key, size_t key_len,
     const uint8_t *data1, size_t data1_len,
     const uint8_t *data2, size_t data2_len,
-    uint8_t output[HKDF_SHA256_HASH_LEN]
+    uint8_t output[RATS_HKDF_SHA256_HASH_LEN]
 );
 
 /**
@@ -57,10 +57,10 @@ void hmac_sha256_2(
  * @param ikm_len  Length of IKM
  * @param prk      Output pseudorandom key (32 bytes)
  */
-void hkdf_sha256_extract(
+void rats_hkdf_sha256_extract(
     const uint8_t *salt, size_t salt_len,
     const uint8_t *ikm, size_t ikm_len,
-    uint8_t prk[HKDF_SHA256_HASH_LEN]
+    uint8_t prk[RATS_HKDF_SHA256_HASH_LEN]
 );
 
 /**
@@ -72,8 +72,8 @@ void hkdf_sha256_extract(
  * @param okm      Output keying material
  * @param okm_len  Length of OKM (max 255 * 32 = 8160 bytes)
  */
-void hkdf_sha256_expand(
-    const uint8_t prk[HKDF_SHA256_HASH_LEN],
+void rats_hkdf_sha256_expand(
+    const uint8_t prk[RATS_HKDF_SHA256_HASH_LEN],
     const uint8_t *info, size_t info_len,
     uint8_t *okm, size_t okm_len
 );
@@ -90,7 +90,7 @@ void hkdf_sha256_expand(
  * @param okm      Output keying material
  * @param okm_len  Length of OKM
  */
-void hkdf_sha256(
+void rats_hkdf_sha256(
     const uint8_t *salt, size_t salt_len,
     const uint8_t *ikm, size_t ikm_len,
     const uint8_t *info, size_t info_len,
@@ -108,11 +108,11 @@ void hkdf_sha256(
  * @param output1      First output key (32 bytes)
  * @param output2      Second output key (32 bytes)
  */
-void noise_hkdf_2(
-    const uint8_t chaining_key[HKDF_SHA256_HASH_LEN],
+void rats_noise_hkdf_2(
+    const uint8_t chaining_key[RATS_HKDF_SHA256_HASH_LEN],
     const uint8_t *input_key, size_t input_len,
-    uint8_t output1[HKDF_SHA256_HASH_LEN],
-    uint8_t output2[HKDF_SHA256_HASH_LEN]
+    uint8_t output1[RATS_HKDF_SHA256_HASH_LEN],
+    uint8_t output2[RATS_HKDF_SHA256_HASH_LEN]
 );
 
 /**
@@ -126,12 +126,12 @@ void noise_hkdf_2(
  * @param output2      Second output key (32 bytes)
  * @param output3      Third output key (32 bytes)
  */
-void noise_hkdf_3(
-    const uint8_t chaining_key[HKDF_SHA256_HASH_LEN],
+void rats_noise_hkdf_3(
+    const uint8_t chaining_key[RATS_HKDF_SHA256_HASH_LEN],
     const uint8_t *input_key, size_t input_len,
-    uint8_t output1[HKDF_SHA256_HASH_LEN],
-    uint8_t output2[HKDF_SHA256_HASH_LEN],
-    uint8_t output3[HKDF_SHA256_HASH_LEN]
+    uint8_t output1[RATS_HKDF_SHA256_HASH_LEN],
+    uint8_t output2[RATS_HKDF_SHA256_HASH_LEN],
+    uint8_t output3[RATS_HKDF_SHA256_HASH_LEN]
 );
 
 #ifdef __cplusplus

package/native-src/src/{noise.cpp → librats/crypto/noise.cpp}

@@ -3,18 +3,18 @@
  * Implements Noise_XX_25519_ChaChaPoly_SHA256
  */
 
-#include "noise.h"
-#include "logger.h"
+#include "librats/crypto/noise.h"
+#include "librats/util/logger.h"
 #include <cstring>
 #include <random>
 #include <iomanip>
 #include <sstream>
 
 extern "C" {
-#include "crypto/chachapoly.h"
-#include "crypto/hkdf.h"
-#include "crypto/sha256.h"
-#include "crypto/curve25519.h"
+#include "librats/crypto/chachapoly.h"
+#include "librats/crypto/hkdf.h"
+#include "librats/crypto/sha256.h"
+#include "librats/crypto/curve25519.h"
 }
 
 // Noise Protocol logging macros
@@ -23,7 +23,7 @@ extern "C" {
 #define LOG_NOISE_WARN(message)  LOG_WARN("noise", message)
 #define LOG_NOISE_ERROR(message) LOG_ERROR("noise", message)
 
-namespace rats {
+namespace librats {
 
 /* Helper to format public key prefix for logging (first 8 hex chars) */
 static std::string format_key_prefix(const uint8_t* key) {
@@ -96,7 +96,7 @@ size_t NoiseCipherState::encrypt_with_ad(
     uint8_t nonce[12];
     make_nonce(nonce, nonce_);
     
-    size_t result = chachapoly_encrypt(
+    size_t result = rats_chachapoly_encrypt(
         key_, nonce,
         ad, ad_len,
         plaintext, pt_len,
@@ -127,48 +127,28 @@ size_t NoiseCipherState::decrypt_with_ad(
     
     if (ct_len < NOISE_TAG_SIZE) {
         LOG_NOISE_ERROR("Ciphertext too small: " << ct_len << " bytes (min: " << NOISE_TAG_SIZE << ")");
-        return 0;
+        return NOISE_DECRYPT_FAILED;
     }
-    
+
     uint8_t nonce[12];
     make_nonce(nonce, nonce_);
-    
-    size_t result = chachapoly_decrypt(
+
+    size_t result = rats_chachapoly_decrypt(
         key_, nonce,
         ad, ad_len,
         ciphertext, ct_len,
         plaintext
     );
-    
-    if (result > 0) {
+
+    /* A valid decryption may return 0 (empty authenticated payload); only the
+     * sentinel signals failure. */
+    if (result != RATS_CHACHAPOLY_DECRYPT_FAILED) {
         nonce_++;
         LOG_NOISE_DEBUG("Decrypted " << ct_len << " bytes -> " << result << " bytes (nonce: " << nonce_ << ")");
-    } else {
-        LOG_NOISE_ERROR("Decryption failed for " << ct_len << " bytes - authentication failed");
+        return result;
     }
-    
-    return result;
-}
-
-void NoiseCipherState::rekey() {
-    if (!has_key_) {
-        LOG_NOISE_WARN("Rekey called but no key is set");
-        return;
-    }
-    
-    uint8_t zeros[NOISE_KEY_SIZE] = {0};
-    uint8_t new_key[NOISE_KEY_SIZE + NOISE_TAG_SIZE];
-    
-    uint8_t nonce[12];
-    /* Use max nonce value for rekey */
-    memset(nonce, 0xFF, 12);
-    
-    chachapoly_encrypt(key_, nonce, nullptr, 0, zeros, NOISE_KEY_SIZE, new_key);
-    
-    memcpy(key_, new_key, NOISE_KEY_SIZE);
-    secure_zero(new_key, sizeof(new_key));
-    
-    LOG_NOISE_INFO("CipherState rekeyed successfully");
+    LOG_NOISE_ERROR("Decryption failed for " << ct_len << " bytes - authentication failed");
+    return NOISE_DECRYPT_FAILED;
 }
 
 void NoiseCipherState::clear() {
@@ -197,7 +177,7 @@ void NoiseSymmetricState::initialize_symmetric(const char* protocol_name) {
         memcpy(h_, protocol_name, name_len);
     } else {
         /* Otherwise, hash the protocol name */
-        sha256_hash(h_, protocol_name, name_len);
+        rats_sha256_hash(h_, protocol_name, name_len);
     }
     
     /* ck = h */
@@ -210,7 +190,7 @@ void NoiseSymmetricState::mix_key(const uint8_t* input_key_material, size_t len)
     uint8_t temp_k[NOISE_KEY_SIZE];
     
     /* HKDF(ck, input_key_material) -> (new_ck, temp_k) */
-    noise_hkdf_2(ck_, input_key_material, len, ck_, temp_k);
+    rats_noise_hkdf_2(ck_, input_key_material, len, ck_, temp_k);
     
     /* Initialize cipher with temp_k */
     cipher_.initialize_key(temp_k);
@@ -222,11 +202,11 @@ void NoiseSymmetricState::mix_key(const uint8_t* input_key_material, size_t len)
 
 void NoiseSymmetricState::mix_hash(const uint8_t* data, size_t len) {
     /* h = SHA256(h || data) */
-    sha256_context_t ctx;
-    sha256_reset(&ctx);
-    sha256_update(&ctx, h_, NOISE_HASH_SIZE);
-    sha256_update(&ctx, data, len);
-    sha256_finish(&ctx, h_);
+    rats_sha256_context_t ctx;
+    rats_sha256_reset(&ctx);
+    rats_sha256_update(&ctx, h_, NOISE_HASH_SIZE);
+    rats_sha256_update(&ctx, data, len);
+    rats_sha256_finish(&ctx, h_);
     
     LOG_NOISE_DEBUG("MixHash: mixed " << len << " bytes into handshake hash");
 }
@@ -243,7 +223,21 @@ size_t NoiseSymmetricState::encrypt_and_hash(const uint8_t* plaintext, size_t pt
     return ct_len;
 }
 
-size_t NoiseSymmetricState::decrypt_and_hash(const uint8_t* ciphertext, size_t ct_len, uint8_t* plaintext) {
+size_t NoiseSymmetricState::decrypt_and_hash(const uint8_t* ciphertext, size_t ct_len, uint8_t* plaintext, size_t plaintext_cap) {
+    /* Bound the write before touching `plaintext`. A keyed decrypt yields
+     * ct_len - NOISE_TAG_SIZE bytes; a passthrough copy (no key) yields ct_len.
+     * Refuse anything that would overflow the caller's buffer — this is the
+     * guard against an oversized handshake message smashing a fixed-size
+     * payload buffer (the ciphertext length is attacker-controlled). */
+    const size_t pt_max = cipher_has_key()
+        ? (ct_len >= NOISE_TAG_SIZE ? ct_len - NOISE_TAG_SIZE : 0)
+        : ct_len;
+    if (pt_max > plaintext_cap) {
+        LOG_NOISE_ERROR("decrypt_and_hash: plaintext " << pt_max
+                        << " exceeds output buffer capacity " << plaintext_cap);
+        return NOISE_DECRYPT_FAILED;
+    }
+
     /* Save ciphertext for mixing (before decryption modifies anything) */
     /* Mix ciphertext into hash first */
     uint8_t h_backup[NOISE_HASH_SIZE];
@@ -263,7 +257,7 @@ void NoiseSymmetricState::split(NoiseCipherState& c1, NoiseCipherState& c2) {
     uint8_t temp_k2[NOISE_KEY_SIZE];
     
     /* HKDF(ck, empty) -> (temp_k1, temp_k2) */
-    noise_hkdf_2(ck_, nullptr, 0, temp_k1, temp_k2);
+    rats_noise_hkdf_2(ck_, nullptr, 0, temp_k1, temp_k2);
     
     c1.initialize_key(temp_k1);
     c2.initialize_key(temp_k2);
@@ -303,7 +297,7 @@ void NoiseHandshakeState::generate_ephemeral() {
     e_.private_key[31] |= 64;
     
     /* Derive public key */
-    curve25519_donna(e_.public_key, e_.private_key, curve25519_basepoint);
+    rats_curve25519_donna(e_.public_key, e_.private_key, rats_curve25519_basepoint);
     e_.has_keys = true;
     
     LOG_NOISE_DEBUG("Generated ephemeral keypair (pub: " << format_key_prefix(e_.public_key) << "...)");
@@ -312,7 +306,7 @@ void NoiseHandshakeState::generate_ephemeral() {
 void NoiseHandshakeState::mix_dh(const uint8_t* local_private, const uint8_t* remote_public) {
     uint8_t dh_output[NOISE_DH_SIZE];
     
-    curve25519_donna(dh_output, local_private, remote_public);
+    rats_curve25519_donna(dh_output, local_private, remote_public);
     symmetric_.mix_key(dh_output, NOISE_DH_SIZE);
     
     secure_zero(dh_output, NOISE_DH_SIZE);
@@ -366,7 +360,7 @@ size_t NoiseHandshakeState::read_s(const uint8_t* in, size_t len) {
         return 0;
     }
     
-    size_t pt_len = symmetric_.decrypt_and_hash(in, expected_len, rs_.public_key);
+    size_t pt_len = symmetric_.decrypt_and_hash(in, expected_len, rs_.public_key, NOISE_DH_SIZE);
     if (pt_len != NOISE_DH_SIZE) {
         LOG_NOISE_ERROR("Read static failed: decryption returned " << pt_len << " bytes (expected " << NOISE_DH_SIZE << ")");
         return 0;
@@ -392,9 +386,12 @@ NoiseError NoiseHandshakeState::initialize(
     /* Initialize symmetric state with protocol name */
     symmetric_.initialize_symmetric(NOISE_PROTOCOL_NAME);
     
-    /* Mix in prologue if provided */
-    if (prologue != nullptr && prologue_len > 0) {
-        symmetric_.mix_hash(prologue, prologue_len);
+    /* Mix in the prologue unconditionally. Per the Noise spec MixHash(prologue) is
+     * always applied — an empty prologue is still hashed (over zero bytes), which
+     * alters the handshake hash, so both peers must do it whether or not one is set. */
+    {
+        static const uint8_t empty = 0;
+        symmetric_.mix_hash(prologue != nullptr ? prologue : &empty, prologue_len);
         LOG_NOISE_DEBUG("Mixed prologue into handshake hash: " << prologue_len << " bytes");
     }
     
@@ -495,14 +492,20 @@ NoiseError NoiseHandshakeState::write_message(
         }
     }
     
-    /* Add payload if provided */
-    if (payload != nullptr && payload_len > 0) {
-        if (offset + payload_len + (symmetric_.cipher_.has_key() ? NOISE_TAG_SIZE : 0) > max_len) {
+    /* Append the payload. Per the Noise spec EncryptAndHash runs on every message,
+     * even with an empty payload: once a key is established this still emits a
+     * 16-byte auth tag and mixes it into the handshake hash (so the message length
+     * and transcript match a spec-compliant peer). */
+    {
+        const uint8_t* pl  = (payload != nullptr) ? payload : reinterpret_cast<const uint8_t*>("");
+        const size_t   pll = (payload != nullptr) ? payload_len : 0;
+        const size_t   tag = symmetric_.cipher_.has_key() ? NOISE_TAG_SIZE : 0;
+        if (offset + pll + tag > max_len) {
             LOG_NOISE_ERROR("Buffer too small for payload");
             return NoiseError::MESSAGE_TOO_LARGE;
         }
-        offset += symmetric_.encrypt_and_hash(payload, payload_len, message_out + offset);
-        LOG_NOISE_DEBUG("Encrypted payload: " << payload_len << " bytes");
+        offset += symmetric_.encrypt_and_hash(pl, pll, message_out + offset);
+        LOG_NOISE_DEBUG("Encrypted payload: " << pll << " bytes");
     }
     
     *message_out_len = offset;
@@ -528,7 +531,11 @@ NoiseError NoiseHandshakeState::read_message(
     }
     
     LOG_NOISE_DEBUG("Reading handshake message " << message_index_ << " (" << (is_initiator_ ? "initiator" : "responder") << "): " << message_len << " bytes");
-    
+
+    /* On input, *payload_out_len carries the capacity of payload_out; capture it
+     * before we overwrite it with the decrypted length below. */
+    const size_t payload_cap = (payload_out_len != nullptr) ? *payload_out_len : 0;
+
     size_t offset = 0;
     size_t consumed;
     
@@ -590,18 +597,19 @@ NoiseError NoiseHandshakeState::read_message(
         }
     }
     
-    /* Decrypt payload if there's remaining data */
-    if (offset < message_len) {
-        size_t remaining = message_len - offset;
-        size_t pt_len = symmetric_.decrypt_and_hash(message + offset, remaining, payload_out);
-        if (pt_len == 0 && remaining > 0) {
+    /* Decrypt-and-hash the trailing payload. This runs on every message, even when
+     * empty: DecryptAndHash mixes the (possibly empty) ciphertext into the handshake
+     * hash, and once keyed it verifies the trailing auth tag. A successful decrypt
+     * may legitimately yield 0 plaintext bytes, so only the sentinel means failure. */
+    {
+        const size_t remaining = message_len - offset;
+        const size_t pt_len = symmetric_.decrypt_and_hash(message + offset, remaining, payload_out, payload_cap);
+        if (pt_len == NOISE_DECRYPT_FAILED) {
             LOG_NOISE_ERROR("Failed to decrypt payload in handshake message");
             return NoiseError::DECRYPT_FAILED;
         }
         *payload_out_len = pt_len;
         LOG_NOISE_DEBUG("Decrypted payload: " << pt_len << " bytes");
-    } else {
-        *payload_out_len = 0;
     }
     
     message_index_++;
@@ -654,10 +662,11 @@ NoiseSession::~NoiseSession() {
     clear();
 }
 
-NoiseError NoiseSession::start(bool is_initiator, const NoiseKeyPair* static_keypair) {
+NoiseError NoiseSession::start(bool is_initiator, const NoiseKeyPair* static_keypair,
+                               const uint8_t* prologue, size_t prologue_len) {
     LOG_NOISE_INFO("Session starting as " << (is_initiator ? "initiator" : "responder"));
     transport_ready_ = false;
-    NoiseError err = handshake_.initialize(is_initiator, static_keypair);
+    NoiseError err = handshake_.initialize(is_initiator, static_keypair, prologue, prologue_len);
     if (err != NoiseError::OK) {
         LOG_NOISE_ERROR("Session start failed: " << static_cast<int>(err));
     }
@@ -745,8 +754,10 @@ size_t NoiseSession::decrypt(const uint8_t* ciphertext, size_t ct_len, uint8_t*
     }
     
     size_t result = recv_cipher_.decrypt_with_ad(nullptr, 0, ciphertext, ct_len, plaintext);
-    if (result > 0) {
+    if (result != NOISE_DECRYPT_FAILED) {
         LOG_NOISE_DEBUG("Session decrypted " << ct_len << " bytes -> " << result << " bytes");
+    } else {
+        LOG_NOISE_ERROR("Session decrypt failed for " << ct_len << " bytes");
     }
     return result;
 }
@@ -778,7 +789,7 @@ void noise_generate_keypair(NoiseKeyPair& keypair) {
     keypair.private_key[31] |= 64;
     
     /* Derive public key */
-    curve25519_donna(keypair.public_key, keypair.private_key, curve25519_basepoint);
+    rats_curve25519_donna(keypair.public_key, keypair.private_key, rats_curve25519_basepoint);
     keypair.has_keys = true;
     
     LOG_NOISE_DEBUG("Generated static keypair (pub: " << format_key_prefix(keypair.public_key) << "...)");
@@ -793,11 +804,11 @@ void noise_derive_public_key(const uint8_t private_key[NOISE_DH_SIZE],
     clamped[31] &= 127;
     clamped[31] |= 64;
     
-    curve25519_donna(public_key, clamped, curve25519_basepoint);
+    rats_curve25519_donna(public_key, clamped, rats_curve25519_basepoint);
     
     secure_zero(clamped, NOISE_DH_SIZE);
     
     LOG_NOISE_DEBUG("Derived public key from private key (pub: " << format_key_prefix(public_key) << "...)");
 }
 
-} /* namespace rats */
+} /* namespace librats */