Function derive_mac_key

nodedb-cluster/src/auth/bundle.rs:50–56

Derive the MAC key as `cluster_secret XOR token_hash`. Both inputs are exactly 32 bytes. The XOR ensures neither value alone is sufficient to forge a MAC — an attacker who has the cluster secret but not the token (or vice versa) cannot produce a valid MAC.

(cluster_secret: &[u8; 32], token_hash: &[u8; 32])

/// is sufficient to forge a MAC — an attacker who has the cluster secret
/// but not the token (or vice versa) cannot produce a valid MAC.
pub fn derive_mac_key(cluster_secret: &[u8; 32], token_hash: &[u8; 32]) -> [u8; 32] {
    let mut key = [0u8; 32];
    for i in 0..32 {
        key[i] = cluster_secret[i] ^ token_hash[i];
    }
    key
}

/// Wrap `bundle_bytes` in an `AuthenticatedJoinBundle`.
pub fn seal_bundle(