Proposed Solution for Implementing Noise in Py-libp2p

[seetadev]

We propose implementing the libp2p Noise protocol in py-libp2p, with full compliance to the /noise protocol specification and interoperability with Go, JS, and Rust libp2p peers.

The solution consists of the following components:

1. Handshake Implementation (Noise_XX)

• Implement the XX handshake pattern, using the Noise Protocol Framework as the base.
• Use X25519 for Diffie-Hellman key exchange, AES-GCM or ChaCha20-Poly1305 for encryption, and SHA256 as the hash function (per spec).
• Support handshake prologue:
  prologue = "libp2p-noise:" + identity_key_protocol
• Encode and verify the remote peer’s identity key via libp2p-compatible signed payloads.

2. Key and Identity Management

• Use libp2p identity keys (e.g., ed25519 or secp256k1) to sign and verify static Noise keys exchanged during the handshake.
• Implement peer ID validation and matching between Noise static keys and libp2p peer IDs.

3. Secure Channel Construction

• After a successful handshake, derive the Noise session transport keys and use them to encrypt/decrypt traffic over the raw connection.
• Wrap the secure channel in the libp2p Connection abstraction with read/write stream support.

4. Multistream-select Integration

• Register /noise as a security protocol option during the secure channel negotiation phase.
• Allow the Python node to select or respond to /noise as part of multistream-select negotiation (/multistream/1.0.0).

5. Fallback and Configurability

• Provide a mechanism to choose between multiple security transports (e.g., Noise, TLS in future).
• Make Noise the default secure transport to align with Go and JS implementations.

6. Testing and Interoperability

• Implement test cases for:

  • Handshake validity,
  • Identity mismatch rejections,
  • Replay resistance,
  • Encrypted stream read/write behavior.

• Test interop with go-libp2p-noise and js-libp2p-noise nodes.

7. Spec Compliance and Maintenance

• Ensure the implementation tracks the libp2p Noise spec .

• Reference implementation and design guidance can be drawn from:

  • go-libp2p-noise,
  • js-libp2p-noise,
  • noiseprotocol.org.

[seetadev]

Noise Implementation Checklist / Tasks

Noise Protocol Core

• Implement Noise XX handshake pattern using X25519, SHA256, and AES-GCM or ChaCha20-Poly1305
• Generate ephemeral and static key pairs
• Serialize/deserialize handshake messages
• Construct prologue and payload as per libp2p spec

Identity Verification

• Sign Noise static public key with libp2p identity key
• Validate identity payload from remote peer
• Match signed key to derived Peer ID
• Reject handshake if identity does not match expected Peer ID

Secure Channel Transport

• Derive symmetric encryption keys from handshake output
• Encrypt/decrypt data using derived session keys
• Wrap the secure transport as a libp2p Connection object
• Integrate with stream multiplexers (e.g., mplex/yamux)

Multistream-select Integration

• Register /noise under secure transports
• Enable selection of /noise during secure channel negotiation
• Ensure fallback to other protocols if Noise not supported by remote peer

Interoperability Tests

• Test handshake with go-libp2p-noise peer
• Test handshake with js-libp2p-noise peer
• Validate secure data exchange between Python and other libp2p implementations

Unit & Integration Tests

• Handshake success and failure cases
• Identity key mismatch detection
• Replay attack protection test
• Noise-encrypted stream read/write correctness

Documentation & Spec Reference

• Add developer docs for the Noise module
• Reference libp2p Noise spec in code and comments
• Describe configuration options (e.g., enabling/disabling Noise, key selection)