From 162b74293ed5b688cc4a2cdebeea71a79e785466 Mon Sep 17 00:00:00 2001
From: Simon Wicky <simon@nymtech.net>
Date: Tue, 20 May 2025 16:08:05 +0200
Subject: [PATCH] resolve non stream-related PR comments

---
 Cargo.lock                    |  1 +
 common/nymnoise/Cargo.toml    |  1 +
 common/nymnoise/src/config.rs | 20 ++++++--------------
 common/nymnoise/src/lib.rs    | 24 +++++++++++-------------
 4 files changed, 19 insertions(+), 27 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index c4ce420cc9..2bbedc4d15 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6434,6 +6434,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "tracing",
+ "zeroize",
 ]
 
 [[package]]
diff --git a/common/nymnoise/Cargo.toml b/common/nymnoise/Cargo.toml
index 07893e59b1..0b437eb5b2 100644
--- a/common/nymnoise/Cargo.toml
+++ b/common/nymnoise/Cargo.toml
@@ -16,6 +16,7 @@ snow = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["net", "io-util", "time"] }
 tokio-util = { workspace = true, features = ["codec"] }
+zeroize = { workspace = true }
 
 # internal
 nym-crypto = { path = "../crypto" }
diff --git a/common/nymnoise/src/config.rs b/common/nymnoise/src/config.rs
index fa862a404f..18e4da3bbd 100644
--- a/common/nymnoise/src/config.rs
+++ b/common/nymnoise/src/config.rs
@@ -115,19 +115,11 @@ impl NoiseConfig {
     // Only for phased update
     //SW This can lead to some troubles if two nodes shares the same IP and one support Noise but not the other. This in only for the progressive update though and there is no workaround
     pub(crate) fn get_noise_support(&self, ip_addr: IpAddr) -> Option<NoiseVersion> {
-        self.network
-            .support
-            .inner
-            .load()
-            .get(&ip_addr)
-            .copied()
-            .or_else(|| {
-                self.network
-                    .support
-                    .inner
-                    .load()
-                    .get(&ip_addr.to_canonical()) // SW default bind address being [::]:1789, it can happen that a responder sees the ipv6-mapped address of the initiator, this check for that
-                    .copied()
-            })
+        let plain_ip_support = self.network.support.inner.load().get(&ip_addr).copied();
+
+        // SW default bind address being [::]:1789, it can happen that a responder sees the ipv6-mapped address of the initiator, this check for that
+        let canonical_ip = &ip_addr.to_canonical();
+        let canonical_ip_support = self.network.support.inner.load().get(canonical_ip).copied();
+        plain_ip_support.or(canonical_ip_support)
     }
 }
diff --git a/common/nymnoise/src/lib.rs b/common/nymnoise/src/lib.rs
index b55958e27e..0728ac3afa 100644
--- a/common/nymnoise/src/lib.rs
+++ b/common/nymnoise/src/lib.rs
@@ -11,6 +11,7 @@ use sha2::{Digest, Sha256};
 use snow::{error::Prerequisite, Builder, Error};
 use tokio::net::TcpStream;
 use tracing::*;
+use zeroize::Zeroizing;
 
 pub mod config;
 pub mod connection;
@@ -21,6 +22,13 @@ const NOISE_PSK_PREFIX: &[u8] = b"NYMTECH_NOISE_dQw4w9WgXcQ";
 
 pub const LATEST_NOISE_VERSION: NoiseVersion = NoiseVersion::V1;
 
+fn generate_psk_v1(responder_pub_key: &x25519::PublicKey) -> [u8; 32] {
+    let mut hasher = Sha256::new();
+    hasher.update(NOISE_PSK_PREFIX);
+    hasher.update(responder_pub_key.to_bytes());
+    hasher.finalize().into()
+}
+
 async fn upgrade_noise_initiator_v1(
     conn: TcpStream,
     config: &NoiseConfig,
@@ -28,15 +36,10 @@ async fn upgrade_noise_initiator_v1(
 ) -> Result<Connection, NoiseError> {
     trace!("Perform Noise Handshake, initiator side");
 
-    let secret = [
-        NOISE_PSK_PREFIX.to_vec(),
-        remote_pub_key.to_bytes().to_vec(),
-    ]
-    .concat();
-    let secret_hash = Sha256::digest(secret);
+    let secret_hash = generate_psk_v1(remote_pub_key);
 
     let handshake = Builder::new(config.pattern.as_str().parse()?)
-        .local_private_key(&config.local_key.private_key().to_bytes())
+        .local_private_key(Zeroizing::new(config.local_key.private_key().to_bytes()).as_ref())
         .remote_public_key(&remote_pub_key.to_bytes())
         .psk(config.pattern.psk_position(), &secret_hash)
         .build_initiator()?;
@@ -86,12 +89,7 @@ async fn upgrade_noise_responder_v1(
 ) -> Result<Connection, NoiseError> {
     trace!("Perform Noise Handshake, responder side");
 
-    let secret = [
-        NOISE_PSK_PREFIX.to_vec(),
-        config.local_key.public_key().to_bytes().to_vec(),
-    ]
-    .concat();
-    let secret_hash = Sha256::digest(secret);
+    let secret_hash = generate_psk_v1(config.local_key.public_key());
 
     let handshake = Builder::new(config.pattern.as_str().parse()?)
         .local_private_key(&config.local_key.private_key().to_bytes())