Module mac 

Symmetric MAC key + HMAC-SHA256 primitive for the authenticated Raft envelope.

Trust model

The MAC key is a cluster-wide 32-byte shared secret generated at bootstrap and distributed to joining nodes out of band (via the mTLS join RPC, L.4). Every legitimate cluster member holds the same key; outside parties do not.

What the MAC buys

Frame replay protection: a frame captured off the wire (or replayed within a compromised TLS session, or across sessions that share the same transport identity) cannot be modified or re-sent by a party that lacks the cluster key. Combined with the per-peer monotonic sequence in the envelope, every frame is consumed at most once.

What the MAC does NOT buy

If a node’s credentials leak wholesale (its mTLS key and its copy of the cluster secret), the attacker can impersonate that node in full. The MAC is defence-in-depth, not a substitute for compromising a node.

Structs

MacKey

Cluster-wide symmetric MAC key.

Constants

MAC_LEN

Length of the MAC tag in bytes. HMAC-SHA256 produces 32 bytes.

Functions

compute_hmac

Compute HMAC-SHA256 over data with key. Length is fixed at MAC_LEN.

verify_hmac

Constant-time verify tag against HMAC-SHA256 over data with key. Returns Err on mismatch.