Merge pull request #886 from mandiant/fix/encrypt-data-using-salsa20-…

…or-chacha

fix encrypt-data-using-salsa20-or-chacha.yml

nursery/encrypt-data-using-salsa20-or-chacha.yml

@@ -15,10 +15,14 @@ rule:
     # The constant words spell "expand 32-byte k" in ASCII (i.e. the 4 words are "expa", "nd 3", "2-by", and "te k")
     - or:
       - description: part of key setup
-      - string: "expand 32-byte k = sigma"
-      - string: "expand 16-byte k = tau"
+      - string: "expand 32-byte k"
+        description: sigma
+      - string: "expand 16-byte k"
+        description: tau
       # if sigma and tau are in contiguous memory, may result in concatenated string
       - string: "expand 32-byte kexpand 16-byte k"
+      - bytes: 65 78 70 61 6E 64 20 33 32 2D 62 79 74 65 20 6B = "expand 32-byte k"
+      - bytes: 65 78 70 61 6E 64 20 31 36 2D 62 79 74 65 20 6B = "expand 16-byte k"
       - and:
         - string: "expa"
         - string: "nd 3"