add noise lib

Cargo.lock

@@ -6411,6 +6411,35 @@ dependencies = [
  "wasmtimer",
 ]
 
+[[package]]
+name = "nym-noise"
+version = "0.1.0"
+dependencies = [
+ "arc-swap",
+ "bytes",
+ "futures",
+ "log",
+ "nym-crypto",
+ "nym-noise-keys",
+ "pin-project",
+ "serde",
+ "sha2 0.10.8",
+ "snow",
+ "thiserror 2.0.12",
+ "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "nym-noise-keys"
+version = "0.1.0"
+dependencies = [
+ "nym-crypto",
+ "schemars",
+ "serde",
+ "utoipa",
+]
+
 [[package]]
 name = "nym-nonexhaustive-delayqueue"
 version = "0.1.0"
@@ -9276,6 +9305,22 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "snow"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "850948bee068e713b8ab860fe1adc4d109676ab4c3b621fd8147f06b261f2f85"
+dependencies = [
+ "aes-gcm",
+ "blake2 0.10.6",
+ "chacha20poly1305",
+ "curve25519-dalek",
+ "rand_core 0.6.4",
+ "rustc_version 0.4.1",
+ "sha2 0.10.8",
+ "subtle 2.6.1",
+]
+
 [[package]]
 name = "socket2"
 version = "0.5.9"

Cargo.toml

@@ -33,7 +33,8 @@ members = [
     "common/commands",
     "common/config",
     "common/cosmwasm-smart-contracts/coconut-dkg",
-    "common/cosmwasm-smart-contracts/contracts-common", "common/cosmwasm-smart-contracts/easy_addr",
+    "common/cosmwasm-smart-contracts/contracts-common",
+    "common/cosmwasm-smart-contracts/easy_addr",
     "common/cosmwasm-smart-contracts/ecash-contract",
     "common/cosmwasm-smart-contracts/group-contract",
     "common/cosmwasm-smart-contracts/mixnet-contract",
@@ -64,6 +65,8 @@ members = [
     "common/nym-id",
     "common/nym-metrics",
     "common/nym_offline_compact_ecash",
+    "common/nymnoise",
+    "common/nymnoise/keys",
     "common/nymsphinx",
     "common/nymsphinx/acknowledgements",
     "common/nymsphinx/addressing",
@@ -131,7 +134,8 @@ members = [
     "tools/internal/testnet-manager",
     "tools/internal/testnet-manager",
     "tools/internal/testnet-manager/dkg-bypass-contract",
-    "tools/internal/testnet-manager/dkg-bypass-contract", "tools/internal/validator-status-check",
+    "tools/internal/testnet-manager/dkg-bypass-contract",
+    "tools/internal/validator-status-check",
     "tools/nym-cli",
     "tools/nym-id-cli",
     "tools/nym-nr-query",
@@ -305,6 +309,7 @@ serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 sha2 = "0.10.9"
 si-scale = "0.2.3"
+snow = "0.9.6"
 sphinx-packet = "=0.6.0"
 sqlx = "0.7.4"
 strum = "0.26"

common/nymnoise/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "nym-noise"
+version = "0.1.0"
+authors = ["Simon Wicky <simon@nymtech.net>"]
+edition = "2021"
+license.workspace = true
+
+[dependencies]
+arc-swap = { workspace = true }
+bytes = { workspace = true }
+futures = { workspace = true }
+log = { workspace = true }
+pin-project = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+sha2 = { workspace = true }
+snow = { workspace = true }
+thiserror = { workspace = true }
+tokio = { workspace = true, features = ["net", "io-util", "time"] }
+tokio-util = { workspace = true, features = ["codec"] }
+
+# internal
+nym-crypto = { path = "../crypto" }
+nym-noise-keys = { path = "keys" }

common/nymnoise/keys/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "nym-noise-keys"
+version = "0.1.0"
+authors = ["Simon Wicky <simon@nymtech.net>"]
+edition = "2021"
+license.workspace = true
+
+[dependencies]
+schemars = { workspace = true, features = ["preserve_order"] }
+serde = { workspace = true, features = ["derive"] }
+utoipa = { workspace = true }
+
+# internal
+nym-crypto = { path = "../../crypto" }

common/nymnoise/keys/src/lib.rs

@@ -0,0 +1,40 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use nym_crypto::asymmetric::x25519;
+use nym_crypto::asymmetric::x25519::serde_helpers::bs58_x25519_pubkey;
+use serde::{Deserialize, Serialize};
+
+#[derive(Copy, Clone, Debug, Serialize, Deserialize)]
+#[serde(from = "u8", into = "u8")]
+pub enum NoiseVersion {
+    V1 = 1,
+    Unknown,
+}
+
+impl From<u8> for NoiseVersion {
+    fn from(value: u8) -> Self {
+        match value {
+            1 => NoiseVersion::V1,
+            _ => NoiseVersion::Unknown,
+        }
+    }
+}
+
+impl From<NoiseVersion> for u8 {
+    fn from(version: NoiseVersion) -> Self {
+        version as u8
+    }
+}
+
+#[derive(Copy, Clone, Debug, Serialize, Deserialize, schemars::JsonSchema, utoipa::ToSchema)]
+pub struct VersionedNoiseKey {
+    #[schemars(with = "u8")]
+    #[schema(value_type = u8)]
+    pub version: NoiseVersion,
+
+    #[schemars(with = "String")]
+    #[serde(with = "bs58_x25519_pubkey")]
+    #[schema(value_type = String)]
+    pub x25519_pubkey: x25519::PublicKey,
+}

common/nymnoise/src/config.rs

@@ -0,0 +1,132 @@
+// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use std::{
+    collections::HashMap,
+    net::{IpAddr, SocketAddr},
+    sync::Arc,
+};
+
+use arc_swap::ArcSwap;
+use nym_crypto::asymmetric::x25519;
+use nym_noise_keys::{NoiseVersion, VersionedNoiseKey};
+
+#[derive(Default, Debug, Clone, Copy)]
+pub enum NoisePattern {
+    #[default]
+    XKpsk3,
+    IKpsk2,
+}
+
+impl NoisePattern {
+    pub(crate) fn as_str(&self) -> &'static str {
+        match self {
+            Self::XKpsk3 => "Noise_XKpsk3_25519_AESGCM_SHA256",
+            Self::IKpsk2 => "Noise_IKpsk2_25519_ChaChaPoly_BLAKE2s", //Wireguard handshake (not exactly though)
+        }
+    }
+
+    pub(crate) fn psk_position(&self) -> u8 {
+        //automatic parsing, works for correct pattern, more convenient
+        match self.as_str().find("psk") {
+            Some(n) => {
+                let psk_index = n + 3;
+                let psk_char = self.as_str().chars().nth(psk_index).unwrap();
+                psk_char.to_string().parse().unwrap()
+                //if this fails, it means hardcoded pattern are wrong
+            }
+            None => 0,
+        }
+    }
+}
+
+#[derive(Debug, Default)]
+struct SocketAddrToKey {
+    inner: ArcSwap<HashMap<SocketAddr, VersionedNoiseKey>>,
+}
+
+// SW NOTE : Only for phased upgrade. To remove once we decide all nodes have to support Noise
+#[derive(Debug, Default)]
+struct IpAddrToVersion {
+    inner: ArcSwap<HashMap<IpAddr, NoiseVersion>>,
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct NoiseNetworkView {
+    keys: Arc<SocketAddrToKey>,
+    support: Arc<IpAddrToVersion>,
+}
+
+impl NoiseNetworkView {
+    pub fn new_empty() -> Self {
+        NoiseNetworkView {
+            keys: Default::default(),
+            support: Default::default(),
+        }
+    }
+
+    pub fn swap_view(&self, new: HashMap<SocketAddr, VersionedNoiseKey>) {
+        let noise_support = new
+            .iter()
+            .map(|(s_addr, key)| (s_addr.ip(), key.version))
+            .collect::<HashMap<_, _>>();
+        self.keys.inner.store(Arc::new(new));
+        self.support.inner.store(Arc::new(noise_support));
+    }
+}
+
+#[derive(Clone)]
+pub struct NoiseConfig {
+    network: NoiseNetworkView,
+
+    pub(crate) local_key: Arc<x25519::KeyPair>,
+    pub(crate) pattern: NoisePattern,
+
+    pub(crate) unsafe_disabled: bool, // allows for nodes to not attempt to do a noise handshake, VERY UNSAFE, FOR DEBUG PURPOSE ONLY
+}
+
+impl NoiseConfig {
+    pub fn new(noise_key: Arc<x25519::KeyPair>, network: NoiseNetworkView) -> Self {
+        NoiseConfig {
+            network,
+            local_key: noise_key,
+            pattern: Default::default(),
+            unsafe_disabled: false,
+        }
+    }
+
+    #[must_use]
+    pub fn with_noise_pattern(mut self, pattern: NoisePattern) -> Self {
+        self.pattern = pattern;
+        self
+    }
+
+    #[must_use]
+    pub fn with_unsafe_disabled(mut self, disabled: bool) -> Self {
+        self.unsafe_disabled = disabled;
+        self
+    }
+
+    pub(crate) fn get_noise_key(&self, s_address: &SocketAddr) -> Option<VersionedNoiseKey> {
+        self.network.keys.inner.load().get(s_address).copied()
+    }
+
+    // Only for phased update
+    //SW This can lead to some troubles if two nodes shares the same IP and one support Noise but not the other. This in only for the progressive update though and there is no workaround
+    pub(crate) fn get_noise_support(&self, ip_addr: IpAddr) -> Option<NoiseVersion> {
+        self.network
+            .support
+            .inner
+            .load()
+            .get(&ip_addr)
+            .copied()
+            .or_else(|| {
+                self.network
+                    .support
+                    .inner
+                    .load()
+                    .get(&ip_addr.to_canonical()) // SW default bind address being [::]:1789, it can happen that a responder sees the ipv6-mapped address of the initiator, this check for that
+                    .copied()
+            })
+    }
+}

common/nymnoise/src/connection.rs

@@ -0,0 +1,72 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use std::io;
+
+use pin_project::pin_project;
+use tokio::{
+    io::{AsyncRead, AsyncWrite},
+    net::TcpStream,
+};
+
+use crate::stream::NoiseStream;
+
+#[pin_project(project = ConnectionProj)]
+pub enum Connection {
+    Tcp(#[pin] TcpStream),
+    Noise(#[pin] NoiseStream),
+}
+
+impl Connection {
+    pub fn peer_addr(&self) -> Result<std::net::SocketAddr, io::Error> {
+        match self {
+            Self::Noise(stream) => stream.peer_addr(),
+            Self::Tcp(stream) => stream.peer_addr(),
+        }
+    }
+}
+
+impl AsyncRead for Connection {
+    fn poll_read(
+        self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+        buf: &mut tokio::io::ReadBuf<'_>,
+    ) -> std::task::Poll<io::Result<()>> {
+        match self.project() {
+            ConnectionProj::Noise(stream) => stream.poll_read(cx, buf),
+            ConnectionProj::Tcp(stream) => stream.poll_read(cx, buf),
+        }
+    }
+}
+
+impl AsyncWrite for Connection {
+    fn poll_write(
+        self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+        buf: &[u8],
+    ) -> std::task::Poll<Result<usize, io::Error>> {
+        match self.project() {
+            ConnectionProj::Noise(stream) => stream.poll_write(cx, buf),
+            ConnectionProj::Tcp(stream) => stream.poll_write(cx, buf),
+        }
+    }
+    fn poll_flush(
+        self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<Result<(), io::Error>> {
+        match self.project() {
+            ConnectionProj::Noise(stream) => stream.poll_flush(cx),
+            ConnectionProj::Tcp(stream) => stream.poll_flush(cx),
+        }
+    }
+
+    fn poll_shutdown(
+        self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<Result<(), io::Error>> {
+        match self.project() {
+            ConnectionProj::Noise(stream) => stream.poll_shutdown(cx),
+            ConnectionProj::Tcp(stream) => stream.poll_shutdown(cx),
+        }
+    }
+}

common/nymnoise/src/error.rs

@@ -0,0 +1,36 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use snow::Error;
+use std::io;
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum NoiseError {
+    #[error("encountered a Noise decryption error")]
+    DecryptionError,
+
+    #[error("encountered a Noise Protocol error - {0}")]
+    ProtocolError(Error),
+
+    #[error("encountered an IO error - {0}")]
+    IoError(#[from] io::Error),
+
+    #[error("Incorrect state")]
+    IncorrectStateError,
+
+    #[error("Handshake did not complete")]
+    HandshakeError,
+
+    #[error("Unknown noise version")]
+    UnknownVersion,
+}
+
+impl From<Error> for NoiseError {
+    fn from(err: Error) -> Self {
+        match err {
+            Error::Decrypt => NoiseError::DecryptionError,
+            err => NoiseError::ProtocolError(err),
+        }
+    }
+}

common/nymnoise/src/lib.rs

@@ -0,0 +1,158 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use crate::config::{NoiseConfig, NoisePattern};
+use crate::connection::Connection;
+use crate::error::NoiseError;
+use crate::stream::NoiseStream;
+use log::*;
+use nym_crypto::asymmetric::x25519;
+use nym_noise_keys::NoiseVersion;
+use sha2::{Digest, Sha256};
+use snow::{error::Prerequisite, Builder, Error};
+use tokio::net::TcpStream;
+
+pub mod config;
+pub mod connection;
+pub mod error;
+pub mod stream;
+
+const NOISE_PSK_PREFIX: &[u8] = b"NYMTECH_NOISE_dQw4w9WgXcQ";
+
+pub const NOISE_VERSION: NoiseVersion = NoiseVersion::V1;
+
+async fn upgrade_noise_initiator_v1(
+    conn: TcpStream,
+    pattern: NoisePattern,
+    local_private_key: &x25519::PrivateKey,
+    remote_pub_key: &x25519::PublicKey,
+) -> Result<Connection, NoiseError> {
+    trace!("Perform Noise Handshake, initiator side");
+
+    let secret = [
+        NOISE_PSK_PREFIX.to_vec(),
+        remote_pub_key.to_bytes().to_vec(),
+    ]
+    .concat();
+    let secret_hash = Sha256::digest(secret);
+
+    let handshake = Builder::new(pattern.as_str().parse()?)
+        .local_private_key(&local_private_key.to_bytes())
+        .remote_public_key(&remote_pub_key.to_bytes())
+        .psk(pattern.psk_position(), &secret_hash)
+        .build_initiator()?;
+
+    let noise_stream = NoiseStream::new(conn, handshake);
+
+    Ok(Connection::Noise(noise_stream.perform_handshake().await?))
+}
+
+pub async fn upgrade_noise_initiator(
+    conn: TcpStream,
+    config: &NoiseConfig,
+) -> Result<Connection, NoiseError> {
+    if config.unsafe_disabled {
+        warn!("Noise is disabled in the config. Not attempting any handshake");
+        return Ok(Connection::Tcp(conn));
+    }
+
+    //Get init material
+    let responder_addr = conn.peer_addr().map_err(|err| {
+        error!("Unable to extract peer address from connection - {err}");
+        Error::Prereq(Prerequisite::RemotePublicKey)
+    })?;
+
+    match config.get_noise_key(&responder_addr) {
+        Some(key) => match key.version {
+            NoiseVersion::V1 => {
+                upgrade_noise_initiator_v1(
+                    conn,
+                    config.pattern,
+                    config.local_key.private_key(),
+                    &key.x25519_pubkey,
+                )
+                .await
+            }
+            NoiseVersion::Unknown => {
+                error!(
+                    "{:?} is announcing an unknown version of Noise",
+                    responder_addr
+                );
+                Err(NoiseError::UnknownVersion)
+            }
+        },
+        None => {
+            warn!(
+                "{:?} can't speak Noise yet, falling back to TCP",
+                responder_addr
+            );
+            Ok(Connection::Tcp(conn))
+        }
+    }
+}
+
+async fn upgrade_noise_responder_v1(
+    conn: TcpStream,
+    pattern: NoisePattern,
+    local_public_key: &x25519::PublicKey,
+    local_private_key: &x25519::PrivateKey,
+) -> Result<Connection, NoiseError> {
+    trace!("Perform Noise Handshake, responder side");
+
+    let secret = [
+        NOISE_PSK_PREFIX.to_vec(),
+        local_public_key.to_bytes().to_vec(),
+    ]
+    .concat();
+    let secret_hash = Sha256::digest(secret);
+
+    let handshake = Builder::new(pattern.as_str().parse()?)
+        .local_private_key(&local_private_key.to_bytes())
+        .psk(pattern.psk_position(), &secret_hash)
+        .build_responder()?;
+
+    let noise_stream = NoiseStream::new(conn, handshake);
+
+    Ok(Connection::Noise(noise_stream.perform_handshake().await?))
+}
+
+pub async fn upgrade_noise_responder(
+    conn: TcpStream,
+    config: &NoiseConfig,
+) -> Result<Connection, NoiseError> {
+    if config.unsafe_disabled {
+        warn!("Noise is disabled in the config. Not attempting any handshake");
+        return Ok(Connection::Tcp(conn));
+    }
+
+    //Get init material
+    let initiator_addr = match conn.peer_addr() {
+        Ok(addr) => addr,
+        Err(err) => {
+            error!("Unable to extract peer address from connection - {err}");
+            return Err(Error::Prereq(Prerequisite::RemotePublicKey).into());
+        }
+    };
+
+    // Port is random and we just need the support info
+    match config.get_noise_support(initiator_addr.ip()) {
+        None => {
+            warn!(
+                "{:?} can't speak Noise yet, falling back to TCP",
+                initiator_addr
+            );
+            Ok(Connection::Tcp(conn))
+        }
+        //responder's info on version is shaky, so initiator has to adapt. This behavior can change in the future
+        Some(_) => {
+            //Existing node supporting Noise
+            upgrade_noise_responder_v1(
+                conn,
+                config.pattern,
+                config.local_key.public_key(),
+                config.local_key.private_key(),
+            )
+            .await
+        }
+    }
+}

common/nymnoise/src/stream.rs

@@ -0,0 +1,191 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: GPL-3.0-only
+
+use crate::error::NoiseError;
+use bytes::BytesMut;
+use futures::{Sink, SinkExt, Stream, StreamExt};
+use pin_project::pin_project;
+use snow::{HandshakeState, TransportState};
+use std::cmp::min;
+use std::collections::VecDeque;
+use std::io;
+use std::pin::Pin;
+use std::task::Poll;
+use tokio::{
+    io::{AsyncRead, AsyncWrite, ReadBuf},
+    net::TcpStream,
+};
+use tokio_util::codec::{Framed, LengthDelimitedCodec};
+
+const MAXMSGLEN: usize = 65535;
+const TAGLEN: usize = 16;
+
+/// Wrapper around a TcpStream
+#[pin_project]
+pub struct NoiseStream {
+    #[pin]
+    inner_stream: Framed<TcpStream, LengthDelimitedCodec>,
+    handshake: Option<HandshakeState>,
+    noise: Option<TransportState>,
+    dec_buffer: VecDeque<u8>,
+}
+
+impl NoiseStream {
+    pub(crate) fn new(inner_stream: TcpStream, handshake: HandshakeState) -> NoiseStream {
+        NoiseStream {
+            inner_stream: LengthDelimitedCodec::builder()
+                .length_field_type::<u16>()
+                .new_framed(inner_stream),
+            handshake: Some(handshake),
+            noise: None,
+            dec_buffer: VecDeque::with_capacity(MAXMSGLEN),
+        }
+    }
+
+    pub(crate) async fn perform_handshake(mut self) -> Result<Self, NoiseError> {
+        //Check if we are in the correct state
+        let Some(mut handshake) = self.handshake else {
+            return Err(NoiseError::IncorrectStateError);
+        };
+        self.handshake = None;
+
+        while !handshake.is_handshake_finished() {
+            if handshake.is_my_turn() {
+                self.send_handshake_msg(&mut handshake).await?;
+            } else {
+                self.recv_handshake_msg(&mut handshake).await?;
+            }
+        }
+
+        self.noise = Some(handshake.into_transport_mode()?);
+        Ok(self)
+    }
+
+    async fn send_handshake_msg(
+        &mut self,
+        handshake: &mut HandshakeState,
+    ) -> Result<(), NoiseError> {
+        let mut buf = BytesMut::zeroed(MAXMSGLEN + TAGLEN);
+        let len = handshake.write_message(&[], &mut buf)?;
+        buf.truncate(len);
+        self.inner_stream.send(buf.into()).await?;
+        Ok(())
+    }
+
+    async fn recv_handshake_msg(
+        &mut self,
+        handshake: &mut HandshakeState,
+    ) -> Result<(), NoiseError> {
+        match self.inner_stream.next().await {
+            Some(Ok(msg)) => {
+                let mut buf = vec![0u8; MAXMSGLEN];
+                handshake.read_message(&msg, &mut buf)?;
+                Ok(())
+            }
+            Some(Err(err)) => Err(NoiseError::IoError(err)),
+            None => Err(NoiseError::HandshakeError),
+        }
+    }
+
+    pub fn peer_addr(&self) -> Result<std::net::SocketAddr, io::Error> {
+        self.inner_stream.get_ref().peer_addr()
+    }
+}
+
+impl AsyncRead for NoiseStream {
+    fn poll_read(
+        self: Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+        buf: &mut ReadBuf<'_>,
+    ) -> Poll<std::io::Result<()>> {
+        let projected_self = self.project();
+
+        match projected_self.inner_stream.poll_next(cx) {
+            Poll::Pending => {
+                //no new data, waking is already scheduled.
+                //Nothing new to decrypt, only check if we can return something from dec_storage, happens after
+            }
+
+            Poll::Ready(Some(Ok(noise_msg))) => {
+                //We have a new moise msg
+                let mut dec_msg = vec![0u8; MAXMSGLEN];
+                let len = match projected_self.noise {
+                    Some(transport_state) => {
+                        match transport_state.read_message(&noise_msg, &mut dec_msg) {
+                            Ok(len) => len,
+                            Err(_) => return Poll::Ready(Err(io::ErrorKind::InvalidInput.into())),
+                        }
+                    }
+                    None => return Poll::Ready(Err(io::ErrorKind::Other.into())),
+                };
+                projected_self.dec_buffer.extend(&dec_msg[..len]);
+            }
+
+            Poll::Ready(Some(Err(err))) => return Poll::Ready(Err(err)),
+
+            //Stream is done, return Ok with nothing in buf
+            Poll::Ready(None) => return Poll::Ready(Ok(())),
+        }
+
+        //check and return what we can
+        let read_len = min(buf.remaining(), projected_self.dec_buffer.len());
+        if read_len > 0 {
+            buf.put_slice(
+                &projected_self
+                    .dec_buffer
+                    .drain(..read_len)
+                    .collect::<Vec<u8>>(),
+            );
+            return Poll::Ready(Ok(()));
+        }
+
+        //If we end up here, it must mean the previous poll_next was pending as well, otherwise something was returned. Hence waking is already scheduled
+        Poll::Pending
+    }
+}
+
+impl AsyncWrite for NoiseStream {
+    fn poll_write(
+        self: Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+        buf: &[u8],
+    ) -> Poll<Result<usize, std::io::Error>> {
+        let mut projected_self = self.project();
+
+        match projected_self.inner_stream.as_mut().poll_ready(cx) {
+            Poll::Pending => Poll::Pending,
+
+            Poll::Ready(Err(err)) => Poll::Ready(Err(err)),
+
+            Poll::Ready(Ok(())) => {
+                let mut noise_buf = BytesMut::zeroed(MAXMSGLEN + TAGLEN);
+
+                let Ok(len) = (match projected_self.noise {
+                    Some(transport_state) => transport_state.write_message(buf, &mut noise_buf),
+                    None => return Poll::Ready(Err(io::ErrorKind::Other.into())),
+                }) else {
+                    return Poll::Ready(Err(io::ErrorKind::InvalidInput.into()));
+                };
+                noise_buf.truncate(len);
+                match projected_self.inner_stream.start_send(noise_buf.into()) {
+                    Ok(()) => Poll::Ready(Ok(buf.len())),
+                    Err(e) => Poll::Ready(Err(e)),
+                }
+            }
+        }
+    }
+
+    fn poll_flush(
+        self: Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+    ) -> Poll<Result<(), std::io::Error>> {
+        self.project().inner_stream.poll_flush(cx)
+    }
+
+    fn poll_shutdown(
+        self: Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+    ) -> Poll<Result<(), std::io::Error>> {
+        self.project().inner_stream.poll_close(cx)
+    }
+}