Noise sv2 hardening - #2283

Merged

bit-aloo merged 27 commits into

stratum-mining:mainfrom

bit-aloo:2026-08-06-noise-sv2-hardening

Aug 19, 2026

Commits on Aug 19, 2026

noise_sv2: zero Initiator chaining key and hash in place
bit-aloo
committed
d0cd8dc
noise_sv2: zero Responder chaining key and hash in place
bit-aloo
committed
1e84740
noise_sv2: test that erase wipes the chaining key and hash
bit-aloo
committed
d50b079
codec_sv2: stop deriving Clone for State and HandshakeRole
bit-aloo
committed
90d35fd
noise_sv2: stop deriving Clone for Initiator and Responder
bit-aloo
committed
38e96fb
noise_sv2: stop deriving Clone for NoiseCodec and its ciphers
bit-aloo
committed
ef8254c
noise_sv2: require CryptoRng for ephemeral key generation
bit-aloo
committed
b495ee6
noise_sv2: split NoiseEngine into directional cipher halves
bit-aloo
committed
52404f9
codec_sv2: extract the noise encrypt path out of encode
bit-aloo
committed
07efd9f
codec_sv2: extract the noise decrypt path out of next_frame
bit-aloo
committed
9a8ccb7
codec_sv2: add transport states for splitting a noise connection
bit-aloo
committed
9c9b9c0
Add transport round trip test
bit-aloo
committed
fe662c5
noise_sv2: wipe key material derived during the handshake
bit-aloo
committed
7a0f6de
noise_sv2: correct the cipher thread-safety rationale
bit-aloo
committed
8de59df
noise_sv2: describe what erase actually wipes
bit-aloo
committed
98d18ad
codec_sv2: leave the noise encoder usable after a failed encryption
bit-aloo
committed
7667b40
codec_sv2: leave the noise decoder usable after a failed decryption
bit-aloo
committed
fcfb185
codec_sv2: let callers check for transport mode before splitting
bit-aloo
committed
9c57a90
codec_sv2: cover chunking and decoder reuse in the transport tests
bit-aloo
committed
ebb3653
codec_sv2: trim the comments added by the transport-state changes
bit-aloo
committed
db5bf0a
fix encoder copy_from_slice when buffer_sv2 is enabled
bit-aloo
committed
4d91a77
noise_sv2: reject certificates with unsupported versions
bit-aloo
committed
15e5969
noise_sv2: erase handshake secrets on completion
bit-aloo
committed
2519446
noise_sv2: wipe the hkdf concat buffers
bit-aloo
committed
acf908f
noise_sv2: fail encryption when the nonce counter is exhausted
bit-aloo
committed
02630c9
noise_sv2: replace hand-rolled wiping with the zeroize crate
bit-aloo
committed
caf81de
Make cipher to resolve to None
bit-aloo
committed
84932f6

Navigation Menu

Uh oh!

Noise sv2 hardening - #2283

Noise sv2 hardening#2283
bit-aloo merged 27 commits into
stratum-mining:mainfrom
bit-aloo:2026-08-06-noise-sv2-hardening

Commits on Aug 19, 2026

noise_sv2: zero Initiator chaining key and hash in place

noise_sv2: zero Responder chaining key and hash in place

noise_sv2: test that erase wipes the chaining key and hash

codec_sv2: stop deriving Clone for State and HandshakeRole

noise_sv2: stop deriving Clone for Initiator and Responder

noise_sv2: stop deriving Clone for NoiseCodec and its ciphers

noise_sv2: require CryptoRng for ephemeral key generation

noise_sv2: split NoiseEngine into directional cipher halves

codec_sv2: extract the noise encrypt path out of encode

codec_sv2: extract the noise decrypt path out of next_frame

codec_sv2: add transport states for splitting a noise connection

Add transport round trip test

noise_sv2: wipe key material derived during the handshake

noise_sv2: correct the cipher thread-safety rationale

noise_sv2: describe what erase actually wipes

codec_sv2: leave the noise encoder usable after a failed encryption

codec_sv2: leave the noise decoder usable after a failed decryption

codec_sv2: let callers check for transport mode before splitting

codec_sv2: cover chunking and decoder reuse in the transport tests

codec_sv2: trim the comments added by the transport-state changes

fix encoder copy_from_slice when buffer_sv2 is enabled

noise_sv2: reject certificates with unsupported versions

noise_sv2: erase handshake secrets on completion

noise_sv2: wipe the hkdf concat buffers

noise_sv2: fail encryption when the nonce counter is exhausted

noise_sv2: replace hand-rolled wiping with the zeroize crate

Make cipher to resolve to None