# Noise Keys

> UCall for Mojo

An interface with `Security.NOISE_XX` learns client keys during the handshake, so it vets them through a `PeerAuthorizer`, and a client calling an "http+noise://" URL vets the server's the same way:

```mojo
def admit(peer_static_key: NoiseKey) -> Bool:
    return peer_static_key == trusted_key

var keys = library.generate_noise_keypair()
var sealed = Interface("0.0.0.0:8546")
sealed.security = Security.NOISE_XX
sealed.noise_private_key = keys[0]
sealed.peer_authorizer = PeerAuthorizer.to[admit]()
```

The authorizer returns a value through the C calling convention, which Mojo 1.2 was confirmed to lower correctly on Linux x86-64; the CI matrix confirms Linux AArch64 and macOS.

`from ucall import Security, PeerAuthorizer`

## NoiseKey

A 32-byte Curve25519 key, private or public, as every Noise handshake takes it.

```mojo
comptime NoiseKey = SIMD[.uint8, 32]
```

## Security

The transport security of an interface or a call, `ucall_security_t` in C.

```mojo
struct Security
```

- `NONE` = `Security(Int32(0))`: No encryption, plain TCP.
- `NOISE_XX` = `Security(Int32(1))`: Trust on first use, needing an authorizer.
- `NOISE_IK` = `Security(Int32(2))`: The client knows the server's public key in advance.
- `NOISE_KK` = `Security(Int32(3))`: Both know each other's public keys in advance.
- `code` `c_int`: The raw `ucall_security_t` value the ABI exchanges.

Conforms to: `Copyable`, `Deinitable`, `Equatable`, `ImplicitlyCopyable`, `Movable`, `RegisterPassable`, `TrivialRegisterPassable`

## PeerAuthorizer

Whether a peer presenting an authenticated static key may proceed past the handshake.

```mojo
struct PeerAuthorizer
```

Noise XX learns keys during the handshake rather than in advance, so it needs one on both sides.
The default admits nobody, as it installs no authorizer at all.

- `callback` `Address`: The `ucall_peer_authorizer_t`; `NULL_ADDRESS` installs none.
- `context` `Address`: Passed verbatim to `callback`; this binding's handlers need none.

Conforms to: `Copyable`, `Defaultable`, `Deinitable`, `ImplicitlyCopyable`, `Movable`, `RegisterPassable`, `TrivialRegisterPassable`

## __init__

No authorizer.

```mojo
def __init__() -> Self
```

## to

An authorizer admitting the peers whose authenticated static key `handler` accepts.

```mojo
def to[handler: def(SIMD[.uint8, 32]) thin -> Bool]() -> Self
```

- `handler` (comptime): Receives the peer's Curve25519 public key, and answers whether it may proceed.