From e2f640961b8ecbfa0ec395e427e35f95323d9a17 Mon Sep 17 00:00:00 2001
From: Emil Bay <github@tixz.dk>
Date: Fri, 6 Sep 2019 13:40:46 +0200
Subject: [PATCH] Check e and s in same message

---
 example.js | 12 ++++++++++--
 index.js   | 19 ++++++++++++++-----
 2 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/example.js b/example.js
index 201762b..dab2f9b 100644
--- a/example.js
+++ b/example.js
@@ -8,12 +8,20 @@ var serverKeys = simpleHandshake.keygen()
 // Make a client/server pair. These are also known as initiator/responder
 var client = simpleHandshake(true, {
   pattern: 'XX',
-  staticKeyPair: clientKeys
+  staticKeyPair: clientKeys,
+  onstatickey: (key, ondone) => {
+    console.log('static key', key)
+    ondone(null)
+  }
 })
 
 var server = simpleHandshake(false, {
   pattern: 'XX',
-  staticKeyPair: serverKeys
+  staticKeyPair: serverKeys,
+  onstatickey: (key, ondone) => {
+    console.log('static key', key)
+    ondone(null)
+  }
 })
 
 // Use a simple Round trip function to do the back and forth.
diff --git a/index.js b/index.js
index d873e99..c3e997f 100644
--- a/index.js
+++ b/index.js
@@ -59,15 +59,24 @@ SimpleHandshake.prototype.recv = function recv (data, cb) {
   var hasREAfter = self.state.re != null
   var hasRSAfter = self.state.rs != null
 
+  // e and s may come in the same message, so we always have to check static
+  // after ephemeral. Assumption here (which holds for all official Noise handshakes)
+  // is that e always comes before s
   if (hasREBefore === false && hasREAfter === true) {
-    return self.onephemeralkey(self.state.re, ondone)
+    return self.onephemeralkey(self.state.re, checkStatic)
   }
 
-  if (hasRSBefore === false && hasRSAfter === true) {
-    return self.onstatickey(self.state.rs, ondone)
-  }
+  return checkStatic()
+
+  function checkStatic (err) {
+    if (err) return ondone(err)
 
-  return ondone()
+    if (hasRSBefore === false && hasRSAfter === true) {
+      return self.onstatickey(self.state.rs, ondone)
+    }
+
+    return ondone()
+  }
 
   function ondone (err) {
     if (err) return self._finish(err, null, cb)