Function authenticate_as_master

cake-core/src/cake/sharding/auth.rs:54–83

Master side of the mutual authentication. Called on the TCP stream immediately after connection, before any Cake protocol messages.

(stream: &mut S, key: &str)

/// Called on the TCP stream immediately after connection, before any Cake
/// protocol messages.
pub async fn authenticate_as_master<S>(stream: &mut S, key: &str) -> Result<()>
where
    S: AsyncReadExt + AsyncWriteExt + Unpin,
{
    let key_bytes = key.as_bytes();

    // Step 1: send nonce to worker
    let master_nonce = random_nonce();
    stream.write_all(&master_nonce).await?;
    stream.flush().await?;

    // Step 2: read worker's HMAC response + worker's nonce in one call
    let mut response = [0u8; HMAC_SIZE + NONCE_SIZE];
    stream.read_exact(&mut response).await?;
    let worker_hmac = &response[..HMAC_SIZE];
    let worker_nonce = &response[HMAC_SIZE..];

    // Step 3: verify worker's HMAC
    let expected = compute_hmac(key_bytes, &master_nonce);
    if !constant_time_eq(worker_hmac, &expected) {
        return Err(anyhow!("worker authentication failed: invalid HMAC"));
    }

    // Step 4: send master's HMAC response
    let master_hmac = compute_hmac(key_bytes, worker_nonce);
    stream.write_all(&master_hmac).await?;
    stream.flush().await?;

    Ok(())
}

/// Worker side of the mutual authentication.
///