Noise module development

[acul71]

@seetadev @varun-r-mallya
See if # TODO Analysis: Noise Security Issues #721
( 2. Static key storage for IK pattern - libp2p/security/noise/transport.py:35 )
is worth to be implemented along with GO Missing Features (I think is not a priority, and can be dismissed for later improvement)

Feature	Python	Go	JavaScript
Noise Pipes	❌	❌	❌
IK Pattern	❌	❌	❌
Static Key Storage	❌	❌	❌
Pattern Selection	❌	❌	❌
XX Pattern	✅	✅	✅
Extensions	❌	✅	✅
Early Data	❌	✅	✅

This is NOT a Python-specific issue - all three implementations (Python, Go, JavaScript) are missing noise pipes and IK pattern support. DEPRECATED in specs https://github.com/libp2p/specs/tree/master/noise#handshake-pattern

Evidence:

1. Python: raise NotImplementedError for noise pipes
2. Go: Only XX pattern implemented, no IK pattern
3. JavaScript: Only XX pattern implemented, no IK pattern

Impact Analysis

Performance Impact:

Missing noise pipes affects all implementations:

• Slower handshakes: Always use 3-message XX instead of 2-message IK
• No optimization: Can't optimize for known peers
• Reduced efficiency: No pattern selection based on peer history

[acul71]

@seetadev @varun-r-mallya
General status of interop in ping test in transport-interop using Noise

Note there is a PR aiming to resolve the rust issue read here:

abhinav.ag — 8/1/25, 11:59 AM
in py-libp2p core modules, there were some changes done in the yamux module only by @Ken Kaneki  which made the interop successful as the end. You can check them out here: https://github.com/libp2p/py-libp2p/pull/620/files#diff-7bd46a9082e5d95daf2b5be6176b4a8e8ea6db2b584e1d304d030224c9aae4bb. 

And on the rust-libp2p side, in the cargo.toml file "rsa" feature is added in libp2p dependency like this:

libp2p = { path = "../../libp2p", features = ["noise", "ping", "tcp", "tokio", "yamux", "rsa"] }


Other than these there were no internal changes 

luca@r17:~/PNL_Launchpad_Curriculum/Libp2p/test-plans-fork/transport-interop$ cat results.csv | grep noise
"go-v0.40 x python-v0.2.9 (tcp, noise, yamux)",success
"go-v0.41 x python-v0.2.9 (tcp, noise, yamux)",success
"go-v0.42 x python-v0.2.9 (tcp, noise, yamux)",success
"js-v2.x x python-v0.2.9 (tcp, noise, yamux)",success
"js-v2.x x python-v0.2.9 (tcp, noise, mplex)",success
"js-v1.x x python-v0.2.9 (tcp, noise, yamux)",success
"js-v1.x x python-v0.2.9 (tcp, noise, mplex)",success
"java-v0.9 x python-v0.2.9 (tcp, noise, yamux)",success
"java-v0.9 x python-v0.2.9 (tcp, noise, mplex)",success
"java-v0.6 x python-v0.2.9 (tcp, noise, yamux)",success
"java-v0.6 x python-v0.2.9 (tcp, noise, mplex)",success
"java-v0.0.1 x python-v0.2.9 (tcp, noise, yamux)",success
"java-v0.0.1 x python-v0.2.9 (tcp, noise, mplex)",success
"nim-v1.10.x x python-v0.2.9 (tcp, noise, yamux)",success
"nim-v1.10.x x python-v0.2.9 (tcp, noise, mplex)",success
"rust-v0.54 x python-v0.2.9 (tcp, noise, yamux)",failure
"rust-v0.54 x python-v0.2.9 (tcp, noise, mplex)",failure
"rust-v0.53 x python-v0.2.9 (tcp, noise, yamux)",failure
"rust-v0.53 x python-v0.2.9 (tcp, noise, mplex)",failure
"python-v0.2.9 x rust-v0.54 (tcp, noise, yamux)",failure
"python-v0.2.9 x rust-v0.54 (tcp, noise, mplex)",failure
"python-v0.2.9 x rust-v0.53 (tcp, noise, yamux)",failure
"python-v0.2.9 x rust-v0.53 (tcp, noise, mplex)",failure
"python-v0.2.9 x python-v0.2.9 (tcp, noise, yamux)",success
"python-v0.2.9 x python-v0.2.9 (tcp, noise, mplex)",success
"python-v0.2.9 x nim-v1.10.x (tcp, noise, yamux)",success
"python-v0.2.9 x nim-v1.10.x (tcp, noise, mplex)",success
"python-v0.2.9 x js-v2.x (tcp, noise, yamux)",success
"python-v0.2.9 x js-v2.x (tcp, noise, mplex)",success
"python-v0.2.9 x js-v1.x (tcp, noise, yamux)",success
"python-v0.2.9 x js-v1.x (tcp, noise, mplex)",success
"python-v0.2.9 x java-v0.9 (tcp, noise, yamux)",success
"python-v0.2.9 x java-v0.9 (tcp, noise, mplex)",success
"python-v0.2.9 x java-v0.6 (tcp, noise, yamux)",success
"python-v0.2.9 x java-v0.6 (tcp, noise, mplex)",success
"python-v0.2.9 x java-v0.0.1 (tcp, noise, yamux)",success
"python-v0.2.9 x java-v0.0.1 (tcp, noise, mplex)",success
"python-v0.2.9 x go-v0.42 (tcp, noise, yamux)",success
"python-v0.2.9 x go-v0.41 (tcp, noise, yamux)",success
"python-v0.2.9 x go-v0.40 (tcp, noise, yamux)",success

[acul71]

@seetadev @varun-r-mallya

Go vs Python Noise Implementation Comparison

Overview

This document provides a comprehensive comparison between the Go-libp2p and Python-libp2p noise protocol implementations, analyzing features, capabilities, and compatibility.

Critical Technical Dependencies

🔥 NEWLY DISCOVERED DEPENDENCIES

1. Protobuf Specification Mismatch

• Issue: Python uses proto3 while Go uses proto2
• Issue: Current protobuf doesn't match Noise protocol specification at all
• Impact: Extensions and early data cannot be properly implemented
• Priority: 🔥 CRITICAL - Must be fixed first

2. Early Data Dependencies

• Discovery: Early data is transmitted through noise extensions in the protobuf in message 2
• Dependency: Extensions support must be implemented BEFORE early data handlers
• Impact: Changes the priority order of implementation
• Priority: 🔥 DEPENDS ON EXTENSIONS

Core Features Comparison

✅ IMPLEMENTED IN BOTH

1. Noise XX Handshake Pattern

• Go: noise.HandshakeXX
• Python: "Noise_XX_25519_ChaChaPoly_SHA256"
• Status: ✅ Identical implementation

2. Cipher Suite

• Go: noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256
• Python: "Noise_XX_25519_ChaChaPoly_SHA256"
• Status: ✅ Identical cipher suite

3. Handshake Payload with Signature

• Go: NoiseHandshakePayload with identity_key and identity_sig
• Python: NoiseHandshakePayload with identity_key and identity_sig
• Status: ✅ Identical payload structure

4. Peer ID Verification

• Go: checkPeerID parameter and validation
• Python: Peer ID verification in handshake
• Status: ✅ Both implement peer ID validation

5. Message Encryption/Decryption

• Go: encrypt and decrypt methods
• Python: encrypt and decrypt methods
• Status: ✅ Identical encryption/decryption

6. Transport Integration

• Go: Implements transport.Upgrader interface
• Python: Implements transport upgrader pattern
• Status: ✅ Both integrate with transport layer

7. Session Management

• Go: Session struct with connection state
• Python: NoiseTransportReadWriter with connection state
• Status: ✅ Both manage session state

Go-Specific Features

❌ MISSING IN PYTHON

1. Extensions Support 🔥 HIGH PRIORITY

// Go implementation
type NoiseExtensions struct {
    WebTransportCerthashes [][]byte
}

• Purpose: Support for protocol extensions like WebTransport
• Python Status: ❌ Not implemented
• Impact: Cannot use advanced libp2p features
• Dependency: Requires protobuf specification update first

2. Early Data Handler 🔥 DEPENDS ON EXTENSIONS

// Go implementation
type EarlyDataHandler interface {
    HandleEarlyData(data []byte) error
}

• Purpose: Handle data before handshake completion
• Python Status: ❌ Not implemented
• Impact: Limited early data capabilities
• Dependency: REQUIRES EXTENSIONS TO BE IMPLEMENTED FIRST

3. Rekey Support

// Go has rekey functionality
func (s *Session) Rekey() error

• Purpose: Periodic rekeying for security
• Python Status: ❌ Not implemented
• Impact: Less frequent key rotation

4. Advanced Error Handling

// Go has specific error types
type NoiseError struct {
    Code    int
    Message string
}

• Python Status: ❌ Basic error handling only
• Impact: Less detailed error information

Python-Specific Features

✅ UNIQUE TO PYTHON

1. Explicit Prefix Handling

# Python has explicit 32-byte prefix support
prefix: bytes = b"\x00" * 32
async def write_msg(self, msg: bytes, prefix_encoded: bool = False)

• Purpose: Handle Go's 32-byte prefix in msg#3
• Go Status: ✅ Handles prefix automatically
• Impact: Better compatibility with Go

2. Async/Await Pattern

# Python uses async/await
async def write_msg(self, msg: bytes) -> None:
async def read_msg(self) -> bytes:

• Go Status: Uses goroutines and channels
• Impact: Different concurrency models

Interoperability Status

✅ FULLY COMPATIBLE

Transport Interop Results (All SUCCESS):

• "go-v0.40 x python-v0.2.9 (tcp, noise, yamux)",success
• "go-v0.41 x python-v0.2.9 (tcp, noise, yamux)",success
• "go-v0.42 x python-v0.2.9 (tcp, noise, yamux)",success
• "python-v0.2.9 x go-v0.42 (tcp, noise, yamux)",success
• "python-v0.2.9 x go-v0.41 (tcp, noise, yamux)",success
• "python-v0.2.9 x go-v0.40 (tcp, noise, yamux)",success

Security Analysis

✅ IDENTICAL SECURITY

Both implementations provide:

• Perfect Forward Secrecy: ✅ Both use Noise XX pattern
• Authentication: ✅ Both verify peer identities
• Encryption: ✅ Both use ChaChaPoly cipher
• Key Exchange: ✅ Both use X25519

Performance Considerations

Go Advantages:

• Native performance: Compiled language
• Lower memory overhead: Direct memory management
• Concurrent connections: Goroutine-based concurrency

Python Advantages:

• Easier development: Higher-level language
• Rich ecosystem: Extensive libraries
• Rapid prototyping: Faster development cycle

Missing Features in Python

Updated Priority Order:

🔥 CRITICAL PRIORITY (Must be done first):

1. Protobuf Specification Update 🔥 CRITICAL
   • Impact: Foundation for all other features
   • Effort: High - requires spec analysis and implementation
   • Dependency: None - this is the foundation

🔥 HIGH PRIORITY (After protobuf update):

2. Extensions Support 🔥 HIGH

   • Impact: Cannot use WebTransport and other advanced features
   • Effort: Medium - requires protobuf schema updates
   • Dependency: Requires protobuf specification update

3. Early Data Handler 🔥 HIGH

   • Impact: Limited early data capabilities
   • Effort: Low - straightforward interface addition
   • Dependency: REQUIRES EXTENSIONS TO BE IMPLEMENTED FIRST

MEDIUM PRIORITY:

4. Rekey Support
   • Impact: Less frequent key rotation
   • Effort: Medium - requires session state management
   • Dependency: None

LOW PRIORITY:

5. Advanced Error Handling
   • Impact: Less detailed error information
   • Effort: Low - error type definitions
   • Dependency: None

Updated Recommendations

Corrected Implementation Order:

Phase 1: Foundation (Critical)

1. Update Protobuf Specification 🔥
   • Research and implement correct Noise protocol protobuf
   • Ensure compatibility with Go implementation
   • Update all related code

Phase 2: Core Features (High Priority)

2. Implement Extensions Support 🔥

   • Add NoiseExtensions protobuf schema
   • Update handshake payload to include extensions
   • Enable WebTransport compatibility

3. Add Early Data Handler 🔥

   • Implement EarlyDataHandler interface
   • Enable early data processing (depends on added basic_host.py #2)
   • Improve handshake efficiency

Phase 3: Advanced Features (Medium Priority)

4. Add Rekey Support
   • Implement periodic rekeying
   • Add rekey configuration options
   • Improve long-term security

Phase 4: Polish (Low Priority)

5. Enhanced Error Handling
   • Define specific error types
   • Improve debugging capabilities
   • Better error reporting

Conclusion

Current Status: ✅ CORE COMPATIBILITY ACHIEVED

The Python noise implementation successfully provides core compatibility with Go-libp2p, enabling full bidirectional communication. However, it's missing several advanced features that are available in the Go implementation.

Key Findings:

• ✅ Core Protocol: Identical implementation
• ✅ Security: Same security guarantees
• ✅ Interoperability: Fully compatible
• ❌ Advanced Features: Missing extensions, early data, rekey
• ❌ Performance: Python has higher overhead
• 🔥 Critical Issue: Protobuf specification mismatch

Updated Priority for Missing Features:

1. Protobuf Specification Update (Critical Priority)
2. Extensions Support (High Priority - depends on added host folder & interface.py #1)
3. Early Data Handler (High Priority - depends on added basic_host.py #2)
4. Rekey Support (Medium Priority)
5. Advanced Error Handling (Low Priority)

References

Repositories

• Go Implementation: /home/luca/PNL_Launchpad_Curriculum/Libp2p/go-libp2p/p2p/security/noise/
• Python Implementation: libp2p/security/noise/
• Transport Interop Tests: /home/luca/PNL_Launchpad_Curriculum/Libp2p/test-plans-fork/transport-interop/

Transport Interop Test Results

All Go ↔ Python Noise tests are SUCCESSFUL:

Go → Python (Go as dialer, Python as listener):

• "go-v0.40 x python-v0.2.9 (tcp, noise, yamux)",success
• "go-v0.41 x python-v0.2.9 (tcp, noise, yamux)",success
• "go-v0.42 x python-v0.2.9 (tcp, noise, yamux)",success

Python → Go (Python as dialer, Go as listener):

• "python-v0.2.9 x go-v0.42 (tcp, noise, yamux)",success
• "python-v0.2.9 x go-v0.41 (tcp, noise, yamux)",success
• "python-v0.2.9 x go-v0.40 (tcp, noise, yamux)",success

[dhuseby]

This might help. Here's how I encoded the Noise handshakes as a domain-specific language and state machine making it trivially easy to add new handshakes: https://github.com/cryptidtech/disco-rs/blob/main/src/handshake.rs