github.com/flynn/noise v1.0.0: NewCipherSuite, NewHandshakeState

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/github.com/flynn/noise@v1.0.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/github.com/flynn/noise@v1.0.0
Demonstrate these symbols/APIs:
  - noise.NewCipherSuite
  - noise.NewHandshakeState

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:8b8126f270ea302fa6960cf64c0a782b16d6d531eba10dc6b54f1fa5e7604634","contract":["noise.NewCipherSuite constructs a CipherSuite with specified DH, Cipher, and Hash algorithms","noise.NewHandshakeState initializes a HandshakeState using Config","noise.HandshakeState.WriteMessage and ReadMessage complete a Noise handshake and return CipherStates","noise.CipherState.Encrypt encrypts plaintext with authentication and Decrypt recovers original plaintext","noise.DH25519 generates valid keypairs for authenticated HandshakeXX"],"goal":"verify pkg:golang/github.com/flynn/noise@v1.0.0","kind":"HOW","packages":["pkg:golang/github.com/flynn/noise@v1.0.0"],"schemaVersion":1,"symbols":["noise.NewCipherSuite","noise.NewHandshakeState"]},"contractCommand":["go","run","./test"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/flynn/noise@v1.0.0"],"schemaVersion":1,"subject":"pkg:golang/github.com/flynn/noise@v1.0.0","symbols":["noise.NewCipherSuite","noise.NewHandshakeState"],"verifierAdapter":"golang@1"}

module example.com/sample

go 1.22.0

require github.com/flynn/noise v1.0.0

require (
	golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2 // indirect
	golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 // indirect
)

github.com/flynn/noise v1.0.0 h1:DlTHqmzmvcEiKj+4RYo/imoswx/4r6iBlCMfVtrMXpQ=
github.com/flynn/noise v1.0.0/go.mod h1:xbMo+0i6+IGbYdJhF31t2eR1BIU0CYc12+BNAKwUTag=
github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2 h1:It14KIkyBFYkHkwZ7k45minvA9aorojkyjGk9KJ5B/w=
golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68 h1:nxC68pudNYkKU6jWhgrqdreuFiOQWj1Fs7T3VrH4Pjw=
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

package main

import (
	"bytes"
	"fmt"
	"os"

	"github.com/flynn/noise"
)

// SetupNoiseSession establishes a Noise NN handshake between initiator and responder.
func SetupNoiseSession() (*noise.CipherState, *noise.CipherState, error) {
	suite := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256)

	initiator, err := noise.NewHandshakeState(noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNN,
		Initiator:   true,
	})
	if err != nil {
		return nil, nil, fmt.Errorf("failed to create initiator handshake state: %w", err)
	}

	responder, err := noise.NewHandshakeState(noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNN,
		Initiator:   false,
	})
	if err != nil {
		return nil, nil, fmt.Errorf("failed to create responder handshake state: %w", err)
	}

	// Handshake Message 1 (initiator -> responder: -> e)
	msg1, _, _, err := initiator.WriteMessage(nil, nil)
	if err != nil {
		return nil, nil, fmt.Errorf("initiator message 1 failed: %w", err)
	}

	_, _, _, err = responder.ReadMessage(nil, msg1)
	if err != nil {
		return nil, nil, fmt.Errorf("responder read message 1 failed: %w", err)
	}

	// Handshake Message 2 (responder -> initiator: <- e, ee)
	msg2, respSend, respRecv, err := responder.WriteMessage(nil, nil)
	if err != nil {
		return nil, nil, fmt.Errorf("responder message 2 failed: %w", err)
	}

	_, initRecv, initSend, err := initiator.ReadMessage(nil, msg2)
	if err != nil {
		return nil, nil, fmt.Errorf("initiator read message 2 failed: %w", err)
	}

	_ = respSend
	_ = initRecv
	return initSend, respRecv, nil
}

func main() {
	initSend, respRecv, err := SetupNoiseSession()
	if err != nil {
		fmt.Fprintf(os.Stderr, "Error setting up Noise session: %v\n", err)
		os.Exit(1)
	}

	message := []byte("Hello via Noise protocol")
	ciphertext, err := initSend.Encrypt(nil, nil, message)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Error encrypting message: %v\n", err)
		os.Exit(1)
	}

	plaintext, err := respRecv.Decrypt(nil, nil, ciphertext)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Error decrypting message: %v\n", err)
		os.Exit(1)
	}

	if !bytes.Equal(plaintext, message) {
		fmt.Fprintf(os.Stderr, "Decrypted message mismatch\n")
		os.Exit(1)
	}

	fmt.Printf("Successfully decrypted message: %s\n", string(plaintext))
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/github.com/flynn/noise@v1.0.0",
  "kind": "HOW",
  "packages": [
    "pkg:golang/github.com/flynn/noise@v1.0.0"
  ],
  "symbols": [
    "noise.NewCipherSuite",
    "noise.NewHandshakeState"
  ]
}

package main

import (
	"bytes"
	"crypto/rand"
	"fmt"
	"os"

	"github.com/flynn/noise"
)

func main() {
	// Assertion 1: noise.NewCipherSuite constructs a CipherSuite with specified DH, Cipher, and Hash algorithms
	suite := noise.NewCipherSuite(noise.DH25519, noise.CipherChaChaPoly, noise.HashSHA256)
	if suite == nil {
		fmt.Fprintf(os.Stderr, "FAIL: NewCipherSuite returned nil\n")
		os.Exit(1)
	}

	// Assertion 2: noise.NewHandshakeState initializes a HandshakeState using Config
	initHs, err := noise.NewHandshakeState(noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNN,
		Initiator:   true,
	})
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: initiator NewHandshakeState failed: %v\n", err)
		os.Exit(1)
	}
	if initHs == nil {
		fmt.Fprintf(os.Stderr, "FAIL: initiator HandshakeState is nil\n")
		os.Exit(1)
	}

	respHs, err := noise.NewHandshakeState(noise.Config{
		CipherSuite: suite,
		Pattern:     noise.HandshakeNN,
		Initiator:   false,
	})
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: responder NewHandshakeState failed: %v\n", err)
		os.Exit(1)
	}
	if respHs == nil {
		fmt.Fprintf(os.Stderr, "FAIL: responder HandshakeState is nil\n")
		os.Exit(1)
	}

	// Assertion 3: noise.HandshakeState.WriteMessage and ReadMessage complete a Noise handshake and return CipherStates
	handshakePayload := []byte("handshake-auth-token")
	msg1, cs1Send, cs1Recv, err := initHs.WriteMessage(nil, handshakePayload)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: initHs WriteMessage failed: %v\n", err)
		os.Exit(1)
	}
	if cs1Send != nil || cs1Recv != nil {
		fmt.Fprintf(os.Stderr, "FAIL: handshake unexpectedly returned cipher states after msg 1\n")
		os.Exit(1)
	}

	payloadRead, cs2Recv, cs2Send, err := respHs.ReadMessage(nil, msg1)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: respHs ReadMessage failed: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(payloadRead, handshakePayload) {
		fmt.Fprintf(os.Stderr, "FAIL: payload mismatch: got %q, want %q\n", payloadRead, handshakePayload)
		os.Exit(1)
	}
	if cs2Recv != nil || cs2Send != nil {
		fmt.Fprintf(os.Stderr, "FAIL: responder unexpectedly returned cipher states after reading msg 1\n")
		os.Exit(1)
	}

	msg2, respSend, respRecv, err := respHs.WriteMessage(nil, nil)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: respHs WriteMessage failed: %v\n", err)
		os.Exit(1)
	}
	if respSend == nil || respRecv == nil {
		fmt.Fprintf(os.Stderr, "FAIL: responder handshake did not complete after msg 2\n")
		os.Exit(1)
	}

	_, initRecv, initSend, err := initHs.ReadMessage(nil, msg2)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: initHs ReadMessage failed: %v\n", err)
		os.Exit(1)
	}
	if initSend == nil || initRecv == nil {
		fmt.Fprintf(os.Stderr, "FAIL: initiator handshake did not complete after reading msg 2\n")
		os.Exit(1)
	}

	// Assertion 4: noise.CipherState.Encrypt encrypts plaintext with authentication and Decrypt recovers original plaintext
	testPlaintext := []byte("confidential message verified by csx contract")
	ciphertext, err := initSend.Encrypt(nil, nil, testPlaintext)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: initSend.Encrypt failed: %v\n", err)
		os.Exit(1)
	}
	if bytes.Equal(ciphertext, testPlaintext) {
		fmt.Fprintf(os.Stderr, "FAIL: ciphertext equals plaintext\n")
		os.Exit(1)
	}

	decrypted, err := respRecv.Decrypt(nil, nil, ciphertext)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: respRecv.Decrypt failed: %v\n", err)
		os.Exit(1)
	}
	if !bytes.Equal(decrypted, testPlaintext) {
		fmt.Fprintf(os.Stderr, "FAIL: decrypted text mismatch: got %q, want %q\n", decrypted, testPlaintext)
		os.Exit(1)
	}

	// Assertion 5: noise.DH25519 generates valid keypairs for authenticated HandshakeXX
	staticInit, err := noise.DH25519.GenerateKeypair(rand.Reader)
	if err != nil {
		fmt.Fprintf(os.Stderr, "FAIL: GenerateKeypair failed: %v\n", err)
		os.Exit(1)
	}
	if len(staticInit.Private) == 0 || len(staticInit.Public) == 0 {
		fmt.Fprintf(os.Stderr, "FAIL: generated empty keypair\n")
		os.Exit(1)
	}

	fmt.Println("PASS: pkg:golang/github.com/flynn/noise@v1.0.0 contract passed")
}