Noise Keys

Interfaces and calls can run over the Noise protocol instead of plain TCP, authenticating both sides by 32-byte Curve25519 static keys.

use std::sync::Arc;
use ucall::*;

let (server_private_key, server_public_key) = generate_noise_keypair()?;
let (client_private_key, _) = generate_noise_keypair()?;
let client_public_key = derive_noise_public_key(&client_private_key);

let sealed = Interface::new("0.0.0.0:8546")
    .security(Security::NoiseXX, server_private_key)
    .peer_authorizer(move |key: &NoiseKey| *key == client_public_key);
let server = Server::new(&[sealed])?;

let client = Client::new(ClientOptions {
    connections: 1,
    noise_private_key: Some(client_private_key),
    peer_authorizer: Some(Arc::new(move |key: &NoiseKey| *key == server_public_key)),
    ..Default::default()
})?;

generate_noise_keypair draws from the operating system’s entropy and fails with Status::IO when it is refused. derive_noise_public_key recovers the public half of a stored private key, which peers compare in their authorizers. Under Noise XX both sides learn each other’s key during the handshake, so both need an authorizer; Noise IK has the client name the server’s key in advance through ClientCallOptions::noise_peer_key. Noise KK has both sides know each other in advance: the interface admits the one key Interface::noise_peer_key names, and the call presents ClientCallOptions::noise_private_key or the client’s own key. An http+noise:// URL implies Noise XX, and a handler reads the client’s authenticated key through Request::peer.