fix key derivation

[david415]

according to @dominictarr 's secret-handshake paper the shared secret resulting from the secret handshake is:

K|a · b|a · B|A · b

where in your code you use a · b and concatenate it with a public key before hashing to derive the shared secret for each unidirectional stream.

[dominictarr]

Ah, this is about setting up box-stream (encryption for the rest of the session) which isn't described in the paper (because it's just about the handshake). The paper is good at describing the reasoning behind the protocol, but we need something more exact (algorithms, and byte lengths, etc) for implementers.

[david415]

i suppose it makes sense to start with the shared secret negotiated by the handshake and then concatenating that with ephemeral public keys to split the shared secret into two shared secrets one for each direction of stream flow.

"Alice and Bob can now use their shared secret, K|a · b|a · B|A · b, with a
bulk encryption protocol to secure a two-way communication channel."