{"record":{"id":"06b4c12e3780fab6","repo":"diem/diem","slug":"noise-client-error-finalizing-secure-connection","errorCode":null,"errorMessage":"noise client: error finalizing secure connection: {0}","messagePattern":"noise client: error finalizing secure connection: (.+?)","errorType":"error_code","errorClass":"NoiseHandshakeError","httpStatus":null,"severity":"error","filePath":"network/src/noise/error.rs","lineNumber":31,"sourceCode":"    #[error(\"noise client: MUST_FIX: missing remote server's public key when dialing\")]\n    MissingServerPublicKey,\n\n    #[error(\"noise client: MUST_FIX: error building handshake init message: {0}\")]\n    BuildClientHandshakeMessageFailed(NoiseError),\n\n    #[error(\"noise client: error sending client handshake init message: {0}\")]\n    ClientWriteFailed(io::Error),\n\n    #[error(\n        \"noise client: error reading server handshake response message, server \\\n         probably rejected our handshake message: {0}\"\n    )]\n    ClientReadFailed(io::Error),\n\n    #[error(\"noise client: error flushing socket after writing: {0}\")]\n    ClientFlushFailed(io::Error),\n\n    #[error(\"noise client: error finalizing secure connection: {0}\")]\n    ClientFinalizeFailed(NoiseError),\n\n    #[error(\"noise server: error reading client handshake init message: {0}\")]\n    ServerReadFailed(io::Error),\n\n    #[error(\"noise server: client peer id is malformed: {0}\")]\n    InvalidClientPeerId(String),\n\n    #[error(\"noise server: detected self-dial: we're trying to connect to ourselves\")]\n    SelfDialDetected,\n\n    #[error(\n        \"noise server: client {0}: client is expecting us to have a different \\\n         public key: {1}\"\n    )]\n    ClientExpectingDifferentPubkey(ShortHexStr, String),\n\n    #[error(\"noise server: client {0}: error parsing handshake init message: {1}\")]","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/diem/diem/blob/fc4714a8ea273b6efe8b13dbce72ea60aad9a16c/network/src/noise/error.rs#L13-L49","documentation":"NoiseHandshakeError::ClientFinalizeFailed wraps a diem_crypto NoiseError raised when the client cannot finalize the secure connection after receiving the server's response — i.e. the second Noise handshake step fails cryptographically. This usually means the peer is not who the client expected (wrong static key) or the response bytes are corrupt/malicious.","triggerScenarios":"Calling the final handshake state transition (e.g. read_message/into_transport) on the client after the server's response arrives, when MAC verification fails, the remote static key doesn't match the expected server pubkey, or the message is malformed.","commonSituations":"Server rotated keys but client config still has the old pubkey; MITM or corrupted traffic; mismatched noise protocol name/pattern between endpoints; bug supplying wrong handshake state.","solutions":["Verify the client's configured server public key matches the server's current static key.","Ensure both sides use the identical Noise protocol name/handshake pattern and cipher suite.","Capture and log the wrapped NoiseError ({0}) to identify MAC vs malformed-message failure.","If keys rotated, update client config and redial; treat repeated failures as a possible security event."],"exampleFix":"// before\ntrusted_pubkey = old_server_key; // rotated\n// after\ntrusted_pubkey = fetch_current_server_key(peer_id); // update after rotation","handlingStrategy":"try-catch","validationCode":"fn validate_pinned_key(expected: &X25519PublicKey, current: &X25519PublicKey) -> bool {\n    expected == current\n}","typeGuard":null,"tryCatchPattern":"match handshake().await {\n    Err(NoiseHandshakeError::ClientFinalizeFailed(e)) => {\n        error!(\"could not authenticate server: {} — possible key rotation or MITM; do not retry blindly\", e);\n        alert_security_and_refresh_pinned_key();\n    }\n    ok => ok.map(|_| ())?,\n}","preventionTips":["Keep the pinned server public key in sync after any server key rotation.","Pin the exact Noise protocol name/pattern on both sides.","Alert on repeated finalize failures — repeated MAC failures can indicate interception.","Verify key material integrity (hex decode, 32-byte length) at load time."],"tags":["rust","noise-protocol","cryptography","authentication"],"backgroundTag":"noise-handshake-failed","analyzedSha":"fc4714a8ea273b6efe8b13dbce72ea60aad9a16c","analyzedAt":"2026-09-04T21:07:05.890Z","contentChangedAt":"2026-09-04T21:07:05.890Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}