Noise sv2 hardening - #2283

Open

bit-aloo wants to merge 26 commits into

stratum-mining:mainfrom

bit-aloo:2026-08-06-noise-sv2-hardening

Commits on Aug 18, 2026

noise_sv2: zero Initiator chaining key and hash in place
bit-aloo
committed
5f0709c
noise_sv2: zero Responder chaining key and hash in place
bit-aloo
committed
7147c8a
noise_sv2: test that erase wipes the chaining key and hash
bit-aloo
committed
cbbea22
codec_sv2: stop deriving Clone for State and HandshakeRole
bit-aloo
committed
21f7cc1
noise_sv2: stop deriving Clone for Initiator and Responder
bit-aloo
committed
a8ecc39
noise_sv2: stop deriving Clone for NoiseCodec and its ciphers
bit-aloo
committed
347e02a
noise_sv2: require CryptoRng for ephemeral key generation
bit-aloo
committed
8932956
noise_sv2: split NoiseEngine into directional cipher halves
bit-aloo
committed
8068703
codec_sv2: extract the noise encrypt path out of encode
bit-aloo
committed
0c84147
codec_sv2: extract the noise decrypt path out of next_frame
bit-aloo
committed
fb92466
codec_sv2: add transport states for splitting a noise connection
bit-aloo
committed
154584d
Add transport round trip test
bit-aloo
committed
1afa189
noise_sv2: wipe key material derived during the handshake
bit-aloo
committed
14f5fb8
noise_sv2: correct the cipher thread-safety rationale
bit-aloo
committed
c890a4d
noise_sv2: describe what erase actually wipes
bit-aloo
committed
2efbfe0
codec_sv2: leave the noise encoder usable after a failed encryption
bit-aloo
committed
d2e1a2e
codec_sv2: leave the noise decoder usable after a failed decryption
bit-aloo
committed
2566833
codec_sv2: let callers check for transport mode before splitting
bit-aloo
committed
a224515
codec_sv2: cover chunking and decoder reuse in the transport tests
bit-aloo
committed
696233e
codec_sv2: trim the comments added by the transport-state changes
bit-aloo
committed
23be9b6
fix encoder copy_from_slice when buffer_sv2 is enabled
bit-aloo
committed
cdc1617
noise_sv2: reject certificates with unsupported versions
bit-aloo
committed
98ac06e
noise_sv2: erase handshake secrets on completion
bit-aloo
committed
2d7edf4
noise_sv2: wipe the hkdf concat buffers
bit-aloo
committed
2cd6c30
noise_sv2: fail encryption when the nonce counter is exhausted
bit-aloo
committed
f95653d
noise_sv2: replace hand-rolled wiping with the zeroize crate
bit-aloo
committed
8ed3c41

Navigation Menu

Uh oh!

Noise sv2 hardening - #2283

Noise sv2 hardening#2283
bit-aloo wants to merge 26 commits into
stratum-mining:mainfrom
bit-aloo:2026-08-06-noise-sv2-hardening

Commits on Aug 18, 2026

noise_sv2: zero Initiator chaining key and hash in place

noise_sv2: zero Responder chaining key and hash in place

noise_sv2: test that erase wipes the chaining key and hash

codec_sv2: stop deriving Clone for State and HandshakeRole

noise_sv2: stop deriving Clone for Initiator and Responder

noise_sv2: stop deriving Clone for NoiseCodec and its ciphers

noise_sv2: require CryptoRng for ephemeral key generation

noise_sv2: split NoiseEngine into directional cipher halves

codec_sv2: extract the noise encrypt path out of encode

codec_sv2: extract the noise decrypt path out of next_frame

codec_sv2: add transport states for splitting a noise connection

Add transport round trip test

noise_sv2: wipe key material derived during the handshake

noise_sv2: correct the cipher thread-safety rationale

noise_sv2: describe what erase actually wipes

codec_sv2: leave the noise encoder usable after a failed encryption

codec_sv2: leave the noise decoder usable after a failed decryption

codec_sv2: let callers check for transport mode before splitting

codec_sv2: cover chunking and decoder reuse in the transport tests

codec_sv2: trim the comments added by the transport-state changes

fix encoder copy_from_slice when buffer_sv2 is enabled

noise_sv2: reject certificates with unsupported versions

noise_sv2: erase handshake secrets on completion

noise_sv2: wipe the hkdf concat buffers

noise_sv2: fail encryption when the nonce counter is exhausted

noise_sv2: replace hand-rolled wiping with the zeroize crate