Noise Pipe

Noise Protocol Framework · X25519 · HKDF-SHA-256 · AES-256-GCM

Pick a Noise handshake pattern from its DH-operation tokens and watch the chosen pattern deterministically fix the channel's authentication, forward-secrecy, and identity-hiding properties.

Tip: ←/→ step through handshake messages · 1–6 jump to tabs

Pattern Selector

Select a Noise handshake pattern to explore its message flow and security properties. New here? Follow the guided path from the simplest handshake to WireGuard's.

Guided path:

All 13 patterns (simplest → most complex)

Message Sequence

Security Properties

vs TLS

Real-World Use

Token Legend

Handshake Walkthrough

Step through each handshake message to see DH operations, key evolution, and hash updates.

🧩 Anatomy of a token — start here if e, s, ee, es, se, ss look like noise

Every Noise handshake is built from tiny two-letter DH tokens. Each names which two keys get multiplied together. The result is folded into a growing shared secret. Pick a token below and watch the two keys slide into the mixer.

Your role:

Notice: toggling Initiator ↔ Responder physically swaps which side is my key and which is theirs. That is the whole trick behind es and se — the letters name roles (ephemeral, static), and your role decides whether the ephemeral is yours or theirs. Same token, mirrored operands.

On the wire — this message, byte by byte

🔮 Predict before you step

Which running secrets change after this message?

🅰 Initiator state

🅱 Responder state

Break it

Run real attacks against the live handshake state. Each card runs an independent simulation against the currently selected pattern.

1. Flip a ciphertext bit

Encrypt a transport message, flip one bit in the ciphertext, decrypt. Tests the AEAD authentication tag.

2. Swap responder's static key (MitM)

Substitute an attacker's key for the responder's rs. IK/NK trust the pre-known key blindly; XX verifies it during the handshake.

3. Reuse a transport nonce

Force two encryptions at the same n with the same key. AES-GCM is a CTR-mode stream cipher under the hood — reuse leaks the XOR of the two plaintexts.

4. PSK mismatch (IKpsk2 only)

Initiator and responder hold different pre-shared keys. The chaining keys diverge after the psk mix.

5. Replay message 1

Capture the initiator's first message and deliver it to a fresh responder. Noise core has no replay protection — WireGuard adds a TAI64N timestamp.

6. Compromise the static keys — after the fact

Record a transport message, finish the session, then steal both static private keys. Because the session key came from the discarded ephemeral DH, the recorded ciphertext still won't decrypt — while a hypothetical static-only channel leaks instantly. This is forward secrecy shown holding vs breaking.