Fix incorrect IV usage which slightly reduced security

v2fly · Sep 12, 2020 · e2e2661 · e2e2661
1 parent 8661477
commit e2e2661
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/proxy/vmess/encoding/client.go b/proxy/vmess/encoding/client.go
@@ -71,7 +71,7 @@ func NewClientSession(idHash protocol.IDHash, ctx context.Context) *ClientSessio
 	} else {
 		BodyKey := sha256.Sum256(session.requestBodyKey[:])
 		copy(session.responseBodyKey[:], BodyKey[:16])
-		BodyIV := sha256.Sum256(session.requestBodyKey[:])
+		BodyIV := sha256.Sum256(session.requestBodyIV[:])
 		copy(session.responseBodyIV[:], BodyIV[:16])
 	}
 

diff --git a/proxy/vmess/encoding/server.go b/proxy/vmess/encoding/server.go
@@ -374,7 +374,7 @@ func (s *ServerSession) EncodeResponseHeader(header *protocol.ResponseHeader, wr
 	} else {
 		BodyKey := sha256.Sum256(s.requestBodyKey[:])
 		copy(s.responseBodyKey[:], BodyKey[:16])
-		BodyIV := sha256.Sum256(s.requestBodyKey[:])
+		BodyIV := sha256.Sum256(s.requestBodyIV[:])
 		copy(s.responseBodyIV[:], BodyIV[:16])
 	}