slackhq/nebula · error

build noise state: %w

Error message

build noise state: %w

What it means

NewMachine wraps an error returned while initializing the Noise protocol handshake state (cred.buildHandshakeState) with the message 'build noise state: %w'. This happens when the credential's private key or peer static key cannot be used to construct the Noise cipher/handshake (e.g. invalid key length or unsupported pattern).

Source

Thrown at handshake/machine.go:96

	getCred GetCredentialFunc,
	verifier CertVerifier,
	allocIndex IndexAllocator,
	initiator bool,
	subtype header.MessageSubType,
) (*Machine, error) {
	info, err := subtypeInfoFor(subtype)
	if err != nil {
		return nil, err
	}

	cred := getCred(version)
	if cred == nil {
		return nil, fmt.Errorf("%w: %v", ErrNoCredential, version)
	}

	hs, err := cred.buildHandshakeState(initiator, info.pattern)
	if err != nil {
		return nil, fmt.Errorf("build noise state: %w", err)
	}

	return &Machine{
		hs:         hs,
		subtype:    subtype,
		msgs:       info.msgs,
		getCred:    getCred,
		allocIndex: allocIndex,
		verifier:   verifier,
		myVersion:  version,
		result: &Result{
			Initiator: initiator,
			Cipher:    cred.cipherSuite,
		},
	}, nil
}

// Failed returns true if the Machine is in an unrecoverable state.

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Regenerate the node's keypair and certificate with a matching nebula-cert version
2. Verify the key files under the pki config section are complete PEM blocks (no truncation/concatenation)
3. Ensure both peers run compatible Nebula versions so the same Noise pattern is selected

// verify key material loads and has correct length before handshake
block, _ := pem.Decode(keyPEM)
if block == nil || len(block.Bytes) != expectedKeySize {
	return fmt.Errorf("invalid private key material")
}

m, err := handshake.NewMachine(...)
if err != nil {
	if strings.HasPrefix(err.Error(), "build noise state:") {
		// regenerate keypair / check key files
	}
	return err
}

When it happens

Trigger: NewMachine is called and cred.buildHandshakeState(initiator, info.pattern) returns an error — malformed or wrong-size private key material loaded from the pki config, or an unsupported handshake pattern for the negotiated version.

Common situations: Corrupted or truncated key files, keys generated by mismatched tooling versions, custom/old Nebula builds negotiating patterns the noise library doesn't support.

Related errors

• ErrIncompleteHandshake
• ErrMachineFailed
• ErrMissingContent
• ErrUnexpectedContent
• ErrAsymmetricCipherKeys

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/2ac377381cadd256. Report an issue: GitHub.