From a8e040e75fc270a074389da06f043498fc7ca961 Mon Sep 17 00:00:00 2001
From: orignal <i2porignal@yandex.ru>
Date: Thu, 9 Apr 2026 15:56:14 -0400
Subject: [PATCH] fixed incorrect Poly1305 tag of chiper text block in next new
 session reply message

---
 libi2pd/ECIESX25519AEADRatchetSession.cpp | 22 ++++++++++++++++------
 libi2pd/ECIESX25519AEADRatchetSession.h   |  2 +-
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/libi2pd/ECIESX25519AEADRatchetSession.cpp b/libi2pd/ECIESX25519AEADRatchetSession.cpp
index 5cf8947a..12e24e7c 100644
--- a/libi2pd/ECIESX25519AEADRatchetSession.cpp
+++ b/libi2pd/ECIESX25519AEADRatchetSession.cpp
@@ -674,6 +674,8 @@ namespace garlic
 #if OPENSSL_PQ
 		if (m_PQKeys)
 		{
+			m_NSRCK = std::make_unique<std::array<uint8_t, 64> >();
+			memcpy (m_NSRCK->data (), m_CK, 64);
 			size_t cipherTextLen = i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType);
 			std::vector<uint8_t> kemCiphertext(cipherTextLen);
 			m_PQKeys->Encaps (kemCiphertext.data (), sharedSecret);
@@ -683,8 +685,6 @@ namespace garlic
 				LogPrint (eLogWarning, "Garlic: NSR ML-KEM ciphertext section AEAD encryption failed");
 				return false;
 			}
-			m_NSREncodedPQKey = std::make_unique<std::vector<uint8_t> > (cipherTextLen + 16);
-			memcpy (m_NSREncodedPQKey->data (), out + offset, cipherTextLen + 16);
 			MixHash (out + offset, cipherTextLen + 16);
 			MixKey (sharedSecret);
 			offset += cipherTextLen + 16;
@@ -745,16 +745,26 @@ namespace garlic
 #if OPENSSL_PQ
 		if (m_PQKeys)
 		{
-			if (m_NSREncodedPQKey)
+			if (m_NSRCK)
 			{
 				size_t cipherTextLen = i2p::crypto::GetMLKEMCipherTextLen (m_RemoteStaticKeyType);
-				memcpy (out + offset, m_NSREncodedPQKey->data (), cipherTextLen + 16);
+				std::vector<uint8_t> kemCiphertext(cipherTextLen);
+				uint8_t sharedSecret[32];
+				m_PQKeys->Encaps (kemCiphertext.data (), sharedSecret);
+
+				memcpy (m_CK, m_NSRCK->data (), 64); // restore key
+				if (!Encrypt (kemCiphertext.data (), out + offset, cipherTextLen))
+				{
+					LogPrint (eLogWarning, "Garlic: Next NSR ML-KEM ciphertext section AEAD encryption failed");
+					return false;
+				}
 				MixHash (out + offset, cipherTextLen + 16);
+				MixKey (sharedSecret);
 				offset += cipherTextLen + 16;
 			}
 			else
 			{
-				LogPrint (eLogWarning, "Garlic: No stored ML-KEM keys");
+				LogPrint (eLogWarning, "Garlic: No stored CK");
 				return false;
 			}
 		}
@@ -968,7 +978,7 @@ namespace garlic
 				m_EphemeralKeys = nullptr;
 #if OPENSSL_PQ
 				m_PQKeys = nullptr;
-				m_NSREncodedPQKey = nullptr;
+				m_NSRCK = nullptr;
 #endif
 				[[fallthrough]];
 			case eSessionStateEstablished:
diff --git a/libi2pd/ECIESX25519AEADRatchetSession.h b/libi2pd/ECIESX25519AEADRatchetSession.h
index fccac49e..b2e25c91 100644
--- a/libi2pd/ECIESX25519AEADRatchetSession.h
+++ b/libi2pd/ECIESX25519AEADRatchetSession.h
@@ -239,7 +239,7 @@ namespace garlic
 			std::shared_ptr<i2p::crypto::X25519Keys> m_EphemeralKeys;
 #if OPENSSL_PQ
 			std::unique_ptr<i2p::crypto::MLKEMKeys> m_PQKeys;
-			std::unique_ptr<std::vector<uint8_t> > m_NSREncodedPQKey;
+			std::unique_ptr<std::array<uint8_t, 64> > m_NSRCK; // before cipher text encryptio
 #endif
 			SessionState m_State = eSessionStateNew;
 			uint64_t m_SessionCreatedTimestamp = 0, m_LastActivityTimestamp = 0, // incoming (in seconds)