diff --git a/multicastRSA/oaep.go b/multicastRSA/oaep.go
index 771c6c553bd411df0529d29719f20bff5b22bc7e..39679b8fa846e84931d33c0f48f6e3b3f73a664b 100644
--- a/multicastRSA/oaep.go
+++ b/multicastRSA/oaep.go
@@ -286,6 +286,9 @@ func mgf1XOR(out []byte, hash hash.Hash, seed []byte) {
 	for done < len(out) {
 		hash.Write(seed)
 		hash.Write(counter[0:4])
+		// NOTE: while `.Sum(data)` pattern is banned in the xx network
+		// codebase, this is a copy from golang's `crypto/rsa/rsa.go`,
+		// so we will leave it as-is.
 		digest = hash.Sum(digest[:0])
 		hash.Reset()