use distinct tag for key and nonce for sequence watermarking

This commit is contained in:
Shelikhoo
2025-11-20 19:55:41 +00:00
committed by Xiaokang Wang (Shelikhoo)
parent f5109ff585
commit 7ffb36eec9
@@ -62,12 +62,12 @@ func DeriveSequenceWatermarkingKey(primaryKey, clientRandom, serverRandom []byte
combined := append(primaryKey, clientRandom...) // nolint: gocritic
combined = append(combined, serverRandom...)
encryptionKey, err := hkdf.Expand(sha256.New, combined, "v2ray-xv64FXUU-GxMn8UYz-bTy6UDeE:tlsmirror-sequence-watermark"+tag, 32)
encryptionKey, err := hkdf.Expand(sha256.New, combined, "v2ray-xv64FXUU-GxMn8UYz-bTy6UDeE:tlsmirror-sequence-watermark-encryption"+tag, 32)
if err != nil {
return nil, nil, newError("unable to derive encryption key").Base(err)
}
nonceMask, err := hkdf.Expand(sha256.New, combined, "v2ray-xv64FXUU-GxMn8UYz-bTy6UDeE:tlsmirror-sequence-watermark"+tag, 24)
nonceMask, err := hkdf.Expand(sha256.New, combined, "v2ray-xv64FXUU-GxMn8UYz-bTy6UDeE:tlsmirror-sequence-watermark-noncemask"+tag, 24)
if err != nil {
return nil, nil, newError("unable to derive nonce mask").Base(err)
}