From a8b411c8883125e2685090677b354c1f9e395739 Mon Sep 17 00:00:00 2001
From: xieyao <xieyao@xieyao.vip>
Date: Wed, 17 Jun 2026 05:07:28 +0800
Subject: [PATCH] fix: sort public keys in deriveKeys so both sides compute
 matching send/recv keys

---
 sdk/agent.go | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/sdk/agent.go b/sdk/agent.go
index 74711d4..3825855 100644
--- a/sdk/agent.go
+++ b/sdk/agent.go
@@ -1,6 +1,7 @@
 package sdk
 
 import (
+	"bytes"
 	"context"
 	"crypto/cipher"
 	"crypto/sha256"
@@ -635,10 +636,16 @@ func isBroadcastMAC(dst []byte) bool {
 }
 
 func deriveKeys(psk, localPub, remotePub []byte) ([32]byte, [32]byte) {
+	var first, second []byte
+	if bytes.Compare(localPub, remotePub) <= 0 {
+		first, second = localPub, remotePub
+	} else {
+		first, second = remotePub, localPub
+	}
 	h := sha256.New()
 	h.Write(psk)
-	h.Write(localPub)
-	h.Write(remotePub)
+	h.Write(first)
+	h.Write(second)
 	var sendKey [32]byte
 	copy(sendKey[:], h.Sum(nil))