ClusterAuth

ClusterAuth: shared-secret challenge/response for the net-kernel handshake.

Only nodes that hold the cluster secret may join. The challenger sends a random nonce; the responder returns HMAC(secret, nonce) without ever transmitting the secret itself; the challenger recomputes and compares. This is the "shared cluster secret + signed challenge" auth from the distributed-OTP design (an alternative/complement to mutual TLS).

Functions

fnproveprove(secret : String, nonce : String) : String#

fnverifyverify(secret : String, nonce : String, proof : String) : Bool#