<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">IMO this is not an implementation/specification issue, this is a “what handshake pattern are you using, and are you using it correctly” issue.<div class=""><br class=""></div><div class="">The EncryptWithAd operation is specified this way so that you can send cleartext payloads as part of a handshake message that has no key. </div><div class=""><br class=""></div><div class="">Take IK for example:</div><div class=""><br class=""></div><div class=""><pre style="font-family: monospace, monospace; font-size: 0.98em; line-height: 1.25em; background-color: rgb(255, 255, 255); white-space: pre-wrap; overflow-wrap: break-word; margin-top: 0px; margin-bottom: 0px; color: rgb(68, 68, 68); font-variant-ligatures: normal; orphans: 2; widows: 2;" class=""><code style="white-space: pre; font-family: monospace, monospace; font-size: 0.98em; line-height: 1.25em;" class=""> IX:
-> e, s
<- e, ee, se, s, es</code></pre><div class=""><br class=""></div><div class="">You have derived no key at the end of the first message, but it still might be useful to send a payload at the end.</div><div class=""><br class=""></div><div class="">David</div><div><br class=""><blockquote type="cite" class=""><div class="">On May 1, 2020, at 2:08 PM, Justin Cormack <<a href="mailto:justin@specialbusservice.com" class="">justin@specialbusservice.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="">This is a specification, your code does not have to do exactly this so long as it is equivalent.</div><div class="">Obviously staying close is useful and you should reference the differences in comments, but</div><div class="">you don't have to be literal.<br class=""></div><div class=""><br class=""></div><div class="">Justin</div><div class=""><br class=""></div></div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 1 May 2020 at 16:35, Mike Hearn <<a href="mailto:mike@plan99.net" class="">mike@plan99.net</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class=""><div class=""><div class=""><div style="display:none;border:0px none;width:0px;height:0px;overflow:hidden" class=""><img alt="" style="display: none; border: 0px none; width: 0px; height: 0px; overflow: hidden;" width="1" height="0" class=""></div><div class=""><div class="">During a code review a colleague flagged an issue that I don't have a great answer for.<br class=""></div><div class=""><br class=""></div><div class=""> The Noise spec requires that the EncryptWithAd operation might not actually encrypt, if it's called before the key is set. This seems surprising and potentially a source of subtle bugs. I'd have expected an error to be signalled if you attempt an encryption or decryption operation without a key.<br class=""></div><div class=""><br class=""></div><div class="">It appears it's defined this way to make WriteMessage simpler when processing an initial key in the first part of a handshake, before any DH operation has run. Everything being written out can be passed through EncryptAndHash without a special case for the position where no key is available. But translated directly to code this results in a rather odd exception inside the core encryption codepath which just looks all wrong. My colleague was right to flag it, even though the overall protocol and algorithm is correct.<br class=""></div><div class=""><br class=""></div><div class="">Perhaps a future spec revision could adjust the definition of WriteMessage to fork the codepath depending on if 'k' is set, before CipherState is invoked?<br class=""></div><div class=""><br class=""></div><div class="">thanks,<br class=""></div><div class="">-mike</div></div><br class=""><div class=""></div></div></div></div>
_______________________________________________<br class="">
Noise mailing list<br class="">
<a href="mailto:Noise@moderncrypto.org" target="_blank" class="">Noise@moderncrypto.org</a><br class="">
<a href="https://moderncrypto.org/mailman/listinfo/noise" rel="noreferrer" target="_blank" class="">https://moderncrypto.org/mailman/listinfo/noise</a><br class="">
</blockquote></div>
_______________________________________________<br class="">Noise mailing list<br class=""><a href="mailto:Noise@moderncrypto.org" class="">Noise@moderncrypto.org</a><br class="">https://moderncrypto.org/mailman/listinfo/noise<br class=""></div></blockquote></div><br class=""></div></body></html>