github.com/flynn/noise v1.0.0: Config

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify github.com/flynn/noise.Config in pkg:golang/github.com/flynn/noise@v1.0.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/flynn/noise@v1.0.0
Demonstrate these symbols/APIs:
  - github.com/flynn/noise.Config

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:1e56ee24db98d8603832702d2799ea7539e7fc5f7f99f78a59af9ec96ce9f1cd","contract":["noise.Config initializes initiator and responder HandshakeStates with CipherSuite and HandshakePattern","noise.Config accepts Prologue and custom Random source for handshake initialization","noise.Config rejects preshared keys that are not 256-bit","noise.Config with 32-byte PresharedKey and PresharedKeyPlacement configures PSK handshake","noise.Config with StaticKeypair and PeerStatic enables authenticated handshake and encrypted data transfer"],"goal":"verify github.com/flynn/noise.Config in pkg:golang/github.com/flynn/noise@v1.0.0","kind":"HOW","packages":["pkg:golang/github.com/flynn/noise@v1.0.0"],"schemaVersion":1,"symbols":["github.com/flynn/noise.Config"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/flynn/noise@v1.0.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/flynn/noise@v1.0.0","symbols":["github.com/flynn/noise.Config"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.22.0

require github.com/flynn/noise v1.0.0

require (
	golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2 // indirect
	golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 // indirect
)

github.com/flynn/noise v1.0.0 h1:DlTHqmzmvcEiKj+4RYo/imoswx/4r6iBlCMfVtrMXpQ=
github.com/flynn/noise v1.0.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2 h1:It14KIkyBFYkHkwZ7k45minvA9aorojkyjGk9KJ5B/w=
golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 h1:nxC68pudNYkKU6jWhgrqdreuFiOQWj1Fs7T3VrH4Pjw=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

package main

import (
	"bytes"
	"crypto/rand"
	"fmt"
	"os"

	"github.com/flynn/noise"
)

// SetupConfiguredSession demonstrates using noise.Config with custom CipherSuite,
// prologue data, and random source to establish a secure handshake.
func SetupConfiguredSession() (*noise.CipherState, *noise.CipherState, error) {
	suite := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256)
	prologue := []byte("noise-handshake-context-v1")

	initCfg := noise.Config{
		CipherSuite: suite,
		Random:      rand.Reader,
		Pattern:     noise.HandshakeNN,
		Initiator:   true,
		Prologue:    prologue,
	}

	respCfg := noise.Config{
		CipherSuite: suite,
		Random:      rand.Reader,
		Pattern:     noise.HandshakeNN,
		Initiator:   false,
		Prologue:    prologue,
	}

	initiator, err := noise.NewHandshakeState(initCfg)
	if err != nil {
		return nil, nil, fmt.Errorf("initiator handshake state error: %w", err)
	}

	responder, err := noise.NewHandshakeState(respCfg)
	if err != nil {
		return nil, nil, fmt.Errorf("responder handshake state error: %w", err)
	}

	// Message 1: initiator -> responder (-> e)
	msg1, _, _, err := initiator.WriteMessage(nil, nil)
	if err != nil {
		return nil, nil, fmt.Errorf("initiator write msg1 error: %w", err)
	}

	_, _, _, err = responder.ReadMessage(nil, msg1)
	if err != nil {
		return nil, nil, fmt.Errorf("responder read msg1 error: %w", err)
	}

	// Message 2: responder -> initiator (<- e, ee)
	msg2, respSend, respRecv, err := responder.WriteMessage(nil, nil)
	if err != nil {
		return nil, nil, fmt.Errorf("responder write msg2 error: %w", err)
	}

	_, initRecv, initSend, err := initiator.ReadMessage(nil, msg2)
	if err != nil {
		return nil, nil, fmt.Errorf("initiator read msg2 error: %w", err)
	}

	_ = respSend
	_ = initRecv
	return initSend, respRecv, nil
}

func main() {
	initSend, respRecv, err := SetupConfiguredSession()
	if err != nil {
		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
		os.Exit(1)
	}

	plaintext := []byte("Verified Noise Config Handshake")
	ciphertext, err := initSend.Encrypt(nil, nil, plaintext)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Encryption failed: %v\n", err)
		os.Exit(1)
	}

	decrypted, err := respRecv.Decrypt(nil, nil, ciphertext)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Decryption failed: %v\n", err)
		os.Exit(1)
	}

	if !bytes.Equal(decrypted, plaintext) {
		fmt.Fprintf(os.Stderr, "Payload mismatch\n")
		os.Exit(1)
	}

	fmt.Printf("Success: %s\n", string(decrypted))
}

{
  "schemaVersion": 1,
  "goal": "verify github.com/flynn/noise.Config in pkg:golang/github.com/flynn/noise@v1.0.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/flynn/noise@v1.0.0"
  ],
  "symbols": [
    "github.com/flynn/noise.Config"
  ]
}

package main

import (
	"bytes"
	"crypto/rand"
	"fmt"
	"os"

	"github.com/flynn/noise"
)

func main() {
	suite := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256)

	// Assertion 1: noise.Config initializes initiator and responder HandshakeStates with CipherSuite and HandshakePattern
	initCfg1 := noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNN,
		Initiator:   true,
	}
	respCfg1 := noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNN,
		Initiator:   false,
	}
	initHs1, err := noise.NewHandshakeState(initCfg1)
	if err != nil || initHs1 == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 1 initiator NewHandshakeState failed: %v\n", err)
		os.Exit(1)
	}
	respHs1, err := noise.NewHandshakeState(respCfg1)
	if err != nil || respHs1 == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 1 responder NewHandshakeState failed: %v\n", err)
		os.Exit(1)
	}

	// Assertion 2: noise.Config accepts Prologue and custom Random source for handshake initialization
	prologue := []byte("csx-prologue-data")
	initCfg2 := noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNN,
		Initiator:   true,
		Random:      rand.Reader,
		Prologue:    prologue,
	}
	initHs2, err := noise.NewHandshakeState(initCfg2)
	if err != nil || initHs2 == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 2 NewHandshakeState with prologue/random failed: %v\n", err)
		os.Exit(1)
	}

	// Assertion 3: noise.Config rejects preshared keys that are not 256-bit
	invalidPskCfg := noise.Config{
		CipherSuite:  suite,
		Pattern:      noise.HandshakeNN,
		Initiator:    true,
		PresharedKey: []byte("short-invalid-key"),
	}
	_, err = noise.NewHandshakeState(invalidPskCfg)
	if err == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 3 expected error for invalid preshared key length, got nil\n")
		os.Exit(1)
	}

	// Assertion 4: noise.Config with 32-byte PresharedKey and PresharedKeyPlacement configures PSK handshake
	validPsk := make([]byte, 32)
	for i := range validPsk {
		validPsk[i] = byte(i + 1)
	}
	pskCfg := noise.Config{
		CipherSuite:           suite,
		Pattern:               noise.HandshakeNN,
		Initiator:             true,
		PresharedKey:          validPsk,
		PresharedKeyPlacement: 0,
	}
	pskHs, err := noise.NewHandshakeState(pskCfg)
	if err != nil || pskHs == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 4 NewHandshakeState with valid PSK failed: %v\n", err)
		os.Exit(1)
	}

	// Assertion 5: noise.Config with StaticKeypair and PeerStatic enables authenticated handshake and encrypted data transfer
	staticResp, err := suite.GenerateKeypair(rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 5 GenerateKeypair failed: %v\n", err)
		os.Exit(1)
	}

	initAuthCfg := noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNK,
		Initiator:   true,
		PeerStatic:  staticResp.Public,
	}
	respAuthCfg := noise.Config{
		CipherSuite:   suite,
		Pattern:       noise.HandshakeNK,
		Initiator:     false,
		StaticKeypair: staticResp,
	}

	initAuthHs, err := noise.NewHandshakeState(initAuthCfg)
	if err != nil || initAuthHs == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 5 initiator NewHandshakeState failed: %v\n", err)
		os.Exit(1)
	}
	respAuthHs, err := noise.NewHandshakeState(respAuthCfg)
	if err != nil || respAuthHs == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 5 responder NewHandshakeState failed: %v\n", err)
		os.Exit(1)
	}

	// Handshake Message 1: initiator -> responder (-> e, es)
	msg1, _, _, err := initAuthHs.WriteMessage(nil, nil)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 5 initAuthHs WriteMessage failed: %v\n", err)
		os.Exit(1)
	}
	_, _, _, err = respAuthHs.ReadMessage(nil, msg1)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 5 respAuthHs ReadMessage failed: %v\n", err)
		os.Exit(1)
	}

	// Handshake Message 2: responder -> initiator (<- e, ee)
	msg2, respSend, respRecv, err := respAuthHs.WriteMessage(nil, nil)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 5 respAuthHs WriteMessage msg2 failed: %v\n", err)
		os.Exit(1)
	}
	_, initRecv, initSend, err := initAuthHs.ReadMessage(nil, msg2)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 5 initAuthHs ReadMessage msg2 failed: %v\n", err)
		os.Exit(1)
	}

	if initSend == nil || respRecv == nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 5 handshake did not yield valid cipher states\n")
		os.Exit(1)
	}
	_ = respSend
	_ = initRecv

	sampleData := []byte("authenticated contract payload")
	ciphertext, err := initSend.Encrypt(nil, nil, sampleData)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 5 Encrypt failed: %v\n", err)
		os.Exit(1)
	}
	decrypted, err := respRecv.Decrypt(nil, nil, ciphertext)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 5 Decrypt failed: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(decrypted, sampleData) {
		fmt.Fprintf(os.Stderr, "FAIL: Assertion 5 decrypted data mismatch\n")
		os.Exit(1)
	}

	fmt.Println("PASS: pkg:golang/github.com/flynn/noise@v1.0.0 contract passed")
}