openai/codex
1
0
Fork 0
mirror of https://github.com/openai/codex.git synced 2026-09-04 15:08:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(exec-server): keep Noise foundation self-contained

Browse Source 
Co-authored-by: Codex noreply@openai.com
This commit is contained in:
viyatb-oai
2026-06-10 09:45:57 -07:00
parent 29b362f80b
commit 5bd27876ee
2 changed files with 0 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
codex-rs/exec-server/src/noise_channel.rs
View File

@@ -10,7 +10,6 @@
use base64::Engine;
use base64::engine::general_purpose::STANDARD;
use clatter::KeyPair;
use clatter::bytearray::ByteArray;
use clatter::crypto::dh::X25519;
use clatter::traits::Dh;
use clatter::traits::Kem;
@@ -18,12 +17,8 @@ use serde::Deserialize;
use serde::Serialize;
use crate::aws_lc_ml_kem::AwsLcMlKem768;
use crate::aws_lc_ml_kem::PUBLIC_KEY_LEN as MLKEM768_PUBLIC_KEY_LEN;
pub const NOISE_CHANNEL_SUITE: &str = "Noise_hybridIK_X25519+MLKEM768_AESGCM_SHA256";
const X25519_PUBLIC_KEY_LEN: usize = 32;
type DhKeyPair = KeyPair<<X25519 as Dh>::PubKey, <X25519 as Dh>::PrivateKey>;
type KemKeyPair = KeyPair<<AwsLcMlKem768 as Kem>::PubKey, <AwsLcMlKem768 as Kem>::SecretKey>;
@@ -58,35 +53,6 @@ impl NoiseChannelPublicKey {
mlkem768_public_key: STANDARD.encode(kem.public.as_slice()),
}
}
fn decode(
&self,
) -> Result<(<X25519 as Dh>::PubKey, <AwsLcMlKem768 as Kem>::PubKey), NoiseChannelError> {
if self.suite != NOISE_CHANNEL_SUITE {
return Err(NoiseChannelError::InvalidPublicKey(
"unsupported Noise channel suite",
));
}
let dh = STANDARD
.decode(&self.x25519_public_key)
.map_err(|_| NoiseChannelError::InvalidPublicKey("invalid X25519 public key"))?;
let dh: [u8; X25519_PUBLIC_KEY_LEN] = dh
.try_into()
.map_err(|_| NoiseChannelError::InvalidPublicKey("invalid X25519 public key length"))?;
let kem = STANDARD
.decode(&self.mlkem768_public_key)
.map_err(|_| NoiseChannelError::InvalidPublicKey("invalid ML-KEM-768 public key"))?;
if kem.len() != MLKEM768_PUBLIC_KEY_LEN {
return Err(NoiseChannelError::InvalidPublicKey(
"invalid ML-KEM-768 public key length",
));
}
Ok((
dh,
<AwsLcMlKem768 as Kem>::PubKey::from_slice(kem.as_slice()),
))
}
}
/// Endpoint-local static identity for the exec-server Noise-over-relay suite.

16
codex-rs/exec-server/src/noise_channel_tests.rs
View File

@@ -2,22 +2,6 @@ use pretty_assertions::assert_eq;
use super::NOISE_CHANNEL_SUITE;
use super::NoiseChannelIdentity;
use super::NoiseChannelPublicKey;
#[test]
fn public_key_validation_rejects_unknown_suite() {
let key = NoiseChannelIdentity::generate()
.expect("generate identity")
.public_key();
let json = serde_json::to_value(key).expect("serialize key");
let mut object = json.as_object().expect("key object").clone();
object.insert("suite".to_string(), serde_json::json!("unknown"));
let key: NoiseChannelPublicKey =
serde_json::from_value(serde_json::Value::Object(object)).expect("deserialize key");
let initiator = NoiseChannelIdentity::generate().expect("generate initiator identity");
assert!(InitiatorHandshake::start(&initiator, &key, b"prologue", b"").is_err());
}
#[test]
fn public_key_serializes_with_expected_suite() {