Well, a couple months back I attended a talk on a Haskell implementation of the Noise protocol. The programmer admitted that he was a cryptography novice, and

Well, a couple months back I attended a talk on a Haskell implementation of the Noise protocol. The programmer admitted that he was a cryptography novice, and in fact a Haskell novice. As a result the code he wrote is needlessly abstract - for one thing the guy uses Free monads and in turn ropes in template Haskell as part of his state model. I really have no idea what code he's generating. The code has other features that make review challenging - for instance he doesn't qualify any of his imports so it's hard to tell where to look for the functions he's implementing. Maybe you are better at auditing Haskell than I am. As DJ Bernstein writes in various places, one common exploit is to construct an elliptic curve Diffie Helman shared secret with input that isn't a curve point. I really can't tell if the guy is mitigating against this attack or not, but here you can have a look: https://github.com/centromere/cacophony https://github.com/centromere/cacophony