diff --git a/sdk/agent.go b/sdk/agent.go
index 74711d4..3825855 100644
--- a/sdk/agent.go
+++ b/sdk/agent.go
@@ -1,6 +1,7 @@
 package sdk
 
 import (
+	"bytes"
 	"context"
 	"crypto/cipher"
 	"crypto/sha256"
@@ -635,10 +636,16 @@ func isBroadcastMAC(dst []byte) bool {
 }
 
 func deriveKeys(psk, localPub, remotePub []byte) ([32]byte, [32]byte) {
+	var first, second []byte
+	if bytes.Compare(localPub, remotePub) <= 0 {
+		first, second = localPub, remotePub
+	} else {
+		first, second = remotePub, localPub
+	}
 	h := sha256.New()
 	h.Write(psk)
-	h.Write(localPub)
-	h.Write(remotePub)
+	h.Write(first)
+	h.Write(second)
 	var sendKey [32]byte
 	copy(sendKey[:], h.Sum(nil))