The hmac field comment in auth.proto (around line 22) states the tag is computed "over (client_id || timestamp)". timestamp is a uint32 (line 16). Proto3 defines a varint encoding for uint32 inside serialized messages, but the HMAC input is a raw byte string assembled outside any wire format — the comment says nothing about how those 4 bytes are laid out.
A Node written in Go uses big-endian (network byte order) for uint32 by convention; Swift and Kotlin clients default to little-endian. Two implementations that read only the comment would produce different 12-byte HMAC inputs for the same (client_id, timestamp) pair and fail to authenticate against a peer using the opposite convention. The failure is silent from the protocol perspective: the Node simply rejects the Auth and the client sees a closed connection.
Fix: add one sentence to the hmac comment naming the exact encoding, for example "timestamp is encoded as 4 bytes, big-endian (network byte order), before concatenation." Align all client SDKs and the Node implementation to that encoding.
The
hmacfield comment inauth.proto(around line 22) states the tag is computed "over (client_id || timestamp)".timestampis auint32(line 16). Proto3 defines a varint encoding foruint32inside serialized messages, but the HMAC input is a raw byte string assembled outside any wire format — the comment says nothing about how those 4 bytes are laid out.A Node written in Go uses big-endian (network byte order) for uint32 by convention; Swift and Kotlin clients default to little-endian. Two implementations that read only the comment would produce different 12-byte HMAC inputs for the same (client_id, timestamp) pair and fail to authenticate against a peer using the opposite convention. The failure is silent from the protocol perspective: the Node simply rejects the Auth and the client sees a closed connection.
Fix: add one sentence to the
hmaccomment naming the exact encoding, for example "timestamp is encoded as 4 bytes, big-endian (network byte order), before concatenation." Align all client SDKs and the Node implementation to that encoding.