diff --git a/src/transport_layer/stcp_client.c b/src/transport_layer/stcp_client.c
index cb660d47..556df72c 100644
--- a/src/transport_layer/stcp_client.c
+++ b/src/transport_layer/stcp_client.c
@@ -124,6 +124,7 @@ static int client_derive_session(struct stcp_conn *c, const uint8_t *peer_pubkey
     sc_init_ctx(&sc, &c->my_keys);
     if (sc_set_peer_public_key(&sc, peer_pubkey, SC_PEER_PUBKEY_BIN) != SC_OK) { DEBUG_ERROR(DEBUG_CATEGORY_ETCP, "client ECDH failed"); return -1; }
     memcpy(c->session_key, sc.session_key, SC_SESSION_KEY_SIZE);
+    log_dump(DEBUG_LEVEL_ERROR, DEBUG_CATEGORY_DEBUG, "stcp_client session_key", c->session_key, 16);
     if (sc_stream_init(&sc, &c->stream_send, STCP_STREAM_CLIENT_SEND) != SC_OK) { DEBUG_ERROR(DEBUG_CATEGORY_ETCP, "client stream_send init failed"); return -1; }
     if (sc_stream_init(&sc, &c->stream_recv, STCP_STREAM_SERVER_SEND) != SC_OK) { DEBUG_ERROR(DEBUG_CATEGORY_ETCP, "client stream_recv init failed"); return -1; }
     return 0;
@@ -163,8 +164,10 @@ static void process_server_response(struct stcp_conn *c) {
     }
     uint8_t enc_hs[STCP_HS_ENC_SERVER];
     memcpy(enc_hs, c->recv_buf + SC_PUBKEY_ENC_SIZE, STCP_HS_ENC_SERVER);
+    log_dump(DEBUG_LEVEL_ERROR, DEBUG_CATEGORY_DEBUG, "stcp_client enc_hs BEFORE xor", enc_hs, STCP_HS_ENC_SERVER);
     size_t hs_data_len;
     if (decrypt_and_check(enc_hs, STCP_HS_ENC_SERVER, &c->stream_recv, &hs_data_len)) { client_do_close(c, 3); return; }
+    log_dump(DEBUG_LEVEL_ERROR, DEBUG_CATEGORY_DEBUG, "stcp_client enc_hs AFTER xor", enc_hs, STCP_HS_ENC_SERVER);
     uint8_t status = enc_hs[0];
     uint16_t padding_size = (uint16_t)enc_hs[1] | ((uint16_t)enc_hs[2] << 8);
     c->hs_expected_len = SC_PUBKEY_ENC_SIZE + STCP_HS_ENC_SERVER + padding_size;
diff --git a/src/transport_layer/stcp_server.c b/src/transport_layer/stcp_server.c
index f0bdd530..4bcd6bae 100644
--- a/src/transport_layer/stcp_server.c
+++ b/src/transport_layer/stcp_server.c
@@ -173,6 +173,7 @@ static int derive_session_and_streams(struct stcp_conn *c, const uint8_t *peer_p
         return -1;
     }
     memcpy(c->session_key, sc.session_key, SC_SESSION_KEY_SIZE);
+    log_dump(DEBUG_LEVEL_ERROR, DEBUG_CATEGORY_DEBUG, "stcp_server session_key", c->session_key, 16);
     if (sc_stream_init(&sc, &c->stream_send, STCP_STREAM_SERVER_SEND) != SC_OK) {
         DEBUG_ERROR(DEBUG_CATEGORY_ETCP, "stream_send init failed");
         return -1;
@@ -229,6 +230,7 @@ static void finish_client_handshake(struct stcp_conn *c) {
     enc_dst[0] = plain_hs[0]; enc_dst[1] = plain_hs[1]; enc_dst[2] = plain_hs[2];
     enc_dst[3] = (uint8_t)(crc >> 0); enc_dst[4] = (uint8_t)(crc >> 8);
     enc_dst[5] = (uint8_t)(crc >> 16); enc_dst[6] = (uint8_t)(crc >> 24);
+    log_dump(DEBUG_LEVEL_ERROR, DEBUG_CATEGORY_DEBUG, "stcp_server hs_resp BEFORE xor", enc_dst, STCP_HS_ENC_SERVER);
     if (sc_stream_xor(&c->stream_send, enc_dst, STCP_HS_ENC_SERVER) != SC_OK) {
         DEBUG_ERROR(DEBUG_CATEGORY_ETCP, "encrypt failed");
         u_free(resp); stcp_conn_do_close(c, 3); return;