add additional bytes matches

mandiant · Mar 2, 2024 · df7c6f3 · df7c6f3
1 parent 01f4428
commit df7c6f3
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/nursery/encrypt-data-using-salsa20-or-chacha.yml b/nursery/encrypt-data-using-salsa20-or-chacha.yml
@@ -21,6 +21,8 @@ rule:
         description: tau
       # if sigma and tau are in contiguous memory, may result in concatenated string
       - string: "expand 32-byte kexpand 16-byte k"
+      - bytes: 65 78 70 61 6E 64 20 33 32 2D 62 79 74 65 20 6B = "expand 32-byte k"
+      - bytes: 65 78 70 61 6E 64 20 31 36 2D 62 79 74 65 20 6B = "expand 16-byte k"
       - and:
         - string: "expa"
         - string: "nd 3"