1 files changed, 16 insertions, 0 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
index eb96eef..5ebf624 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/crypto.js
@@ -230,8 +230,24 @@ function b64encode(bytes) {
   return btoa(String.fromCharCode(...bytes));
 }
 
+// ── GEK proof (HMAC-SHA256 for handshake challenge) ─────────────────────────
+
+async function hmacGEK(gekRaw, nonceB64, offerFp, answerFp) {
+  const nonce = b64decode(nonceB64);
+  const data = concatBuffers([
+    nonce,
+    offerFp || new Uint8Array(0),
+    answerFp || new Uint8Array(0),
+  ]);
+  const key = await crypto.subtle.importKey(
+    'raw', gekRaw, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+  const sig = await crypto.subtle.sign('HMAC', key, data);
+  return b64encode(new Uint8Array(sig));
+}
+
 // Export for use in app.js
 window.MeshBayCrypto = {
   importGEK, deriveChunkKey, decryptChunk, decryptChunkBin, decryptFile,
   generateGEK, wrapGEK, unwrapGEK, encryptChunk, b64encode, b64decode,
+  hmacGEK,
 };