Why This Matters
Noise powers WireGuard, Lightning Network, and WhatsApp's transport layer — composable security without TLS complexity. Choose a handshake pattern, and the security properties follow. No negotiation, no downgrade attacks, no certificate authorities required.
Tip: ←/→ step through handshake messages · 1–6 jump to tabs
Pattern Selector
Select a Noise handshake pattern to explore its message flow and security properties.
Message Sequence
Security Properties
vs TLS
Real-World Use
Token Legend
Handshake Walkthrough
Step through each handshake message to see DH operations, key evolution, and hash updates.
🔮 Predict before you step
Initiator state
Responder state
Transport Phase
After handshake completion, encrypt and decrypt messages with the derived transport keys. Each direction has an independent nonce counter.
🅰 → 🅱 (initiator sends)
🅱 → 🅰 (responder sends)
Break it
Run real attacks against the live handshake state. Each card runs an independent simulation against the currently selected pattern.
1. Flip a ciphertext bit
Encrypt a transport message, flip one bit in the ciphertext, decrypt. Tests the AEAD authentication tag.
2. Swap responder's static key (MitM)
Substitute an attacker's key for the responder's rs. IK/NK trust the pre-known key blindly; XX verifies it during the handshake.
3. Reuse a transport nonce
Force two encryptions at the same n with the same key. AES-GCM is a CTR-mode stream cipher under the hood — reuse leaks the XOR of the two plaintexts.
4. PSK mismatch (IKpsk2 only)
Initiator and responder hold different pre-shared keys. The chaining keys diverge after the psk mix.
5. Replay message 1
Capture the initiator's first message and deliver it to a fresh responder. Noise core has no replay protection — WireGuard adds a TAI64N timestamp.
Pattern Comparison
Pick patterns to compare side-by-side. Click any property cell to see why it differs.