From f6eb30fc0e33aeaa5847f8b13a16858b810eaeb2 Mon Sep 17 00:00:00 2001
From: yuhan6665 <1588741+yuhan6665@users.noreply.github.com>
Date: Sun, 20 Sep 2026 19:22:30 -0400
Subject: [PATCH] Use newConstantTimeHash for MAC

---
 cipher_suites.go | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/cipher_suites.go b/cipher_suites.go
index 1974a5a..4fe3a68 100644
--- a/cipher_suites.go
+++ b/cipher_suites.go
@@ -417,15 +417,13 @@ func cipherAES(key, iv []byte, isRead bool) any {
 
 // macSHA1 returns a SHA-1 based constant time MAC.
 func macSHA1(key []byte) hash.Hash {
-	//////////////////////////////////// [REALITY] SECTION: do not use newConstantTimeHash
-	//h := sha1.New
+	h := sha1.New
 	// The BoringCrypto SHA1 does not have a constant-time
 	// checksum function, so don't try to use it.
 	//if !boring.Enabled {
-		//h = newConstantTimeHash(h)
+		h = newConstantTimeHash(h)
 	//}
-	return hmac.New(sha1.New, key)
-	//////////////////////////////////// [REALITY] SECTION END
+	return hmac.New(h, key)
 }
 
 // macSHA256 returns a SHA-256 based MAC. This is only supported in TLS 1.2 and