From 4b295e086e920334319e36e99b37f298685872d0 Mon Sep 17 00:00:00 2001 From: JackDoan Date: Wed, 14 Oct 2026 15:27:22 -0500 Subject: [PATCH] handshake: Take the peer's static key from noise once per certificate check --- handshake/machine.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/handshake/machine.go b/handshake/machine.go index 5337b5ad..885930e7 100644 --- a/handshake/machine.go +++ b/handshake/machine.go @@ -389,10 +389,12 @@ func (m *Machine) validateCert(payload Payload) error { m.failed = true return fmt.Errorf("%w: %v", ErrNoCredential, m.myVersion) } + // PeerStatic builds a fresh composite key on every call for hybrid patterns. + peerStatic := m.hs.PeerStatic() rc, err := cert.Recombine( cert.Version(payload.CertVersion), payload.Cert, - m.hs.PeerStatic(), + peerStatic, cred.Cert.Curve(), ) if err != nil { @@ -400,7 +402,7 @@ func (m *Machine) validateCert(payload Payload) error { return fmt.Errorf("recombine cert: %w", err) } - if !bytes.Equal(rc.PublicKey(), m.hs.PeerStatic()) { + if !bytes.Equal(rc.PublicKey(), peerStatic) { m.failed = true return ErrPublicKeyMismatch }