diff --git a/wormhole/transit.go b/wormhole/transit.go
index 065e1548..5e602099 100644
--- a/wormhole/transit.go
+++ b/wormhole/transit.go
@@ -366,17 +366,15 @@ func (d *transportCryptorClassic) writeRecord(msg []byte) error {
 	binary.BigEndian.PutUint64(nonce[crypto.NonceSize-8:], d.nextWriteNonce)
 	d.nextWriteNonce++
 
-	sealedMsg := secretbox.Seal(nil, msg, &nonce, &d.writeKey)
-
-	nonceAndSealedMsg := append(nonce[:], sealedMsg...)
+	sealedMsg := secretbox.Seal(nonce[:], msg, &nonce, &d.writeKey)
 
 	// we do an explit cast to int64 to avoid compilation failures
 	// for 32bit systems.
-	nonceAndSealedMsgSize := int64(len(nonceAndSealedMsg))
+	nonceAndSealedMsgSize := int64(len(sealedMsg))
 
 	if nonceAndSealedMsgSize >= math.MaxUint32 {
-		panic(fmt.Sprintf("writeRecord too large: %d", len(nonceAndSealedMsg)))
+		panic(fmt.Sprintf("writeRecord too large: %d", len(sealedMsg)))
 	}
 
-	return d.conn.writeMsg(nonceAndSealedMsg)
+	return d.conn.writeMsg(sealedMsg)
 }