VICTORY PROOFER
Token format + HMAC-SHA256 checksum checker (self-reported).
VICTORY PROOFER // VERIFIER
This verifier checks the token's format and HMAC-SHA256 checksum only. The signing key is delivered to your browser inside the page bundle, so anyone can mint a token: it is a keepsake, not a proof of identity.
HMAC-SHA256 checksum is valid. Caveat: the signing key ships to the browser with this page, so the token shows the format is well-formed — not that the puzzle was solved.
The HMAC-SHA256 signature or structure of the entered token is invalid.
RESEARCH & LEARNING VAULT // HMAC Token Checker (Self-Reported)
Keyed-Hash Message Authentication Code (HMAC), nonces, and local checksum verification.
Introduced by Bellare, Canetti, and Krawczyk in 1996 (RFC 2104), HMAC proves a message was authenticated by a holder of the shared secret key. That guarantee holds only while the key stays secret — here it is delivered inside the client bundle, so this deployment cannot authenticate anyone and the token is a self-reported keepsake.
Parses structured victory tokens (RABBITHOLE-<TS_HEX>-<NONCE_HEX>-<SIG_HEX>), evaluates the 32-bit timestamp, and re-computes the HMAC-SHA256 checksum locally with zero server roundtrips. It validates structure and integrity against bit-flips — not authorship.
🎯 Action:Paste the token minted by the terminal easter egg — or hand-craft one, since the signing key ships in the page bundle.
✨ Observe:Instant breakdown showing the declared timestamp, UTC time, entropy nonce, and particle celebration. This is a self-reported keepsake, not an authorship proof.
🎯 Action:Modify a single character of a token and click Verify.
✨ Observe:Immediate checksum rejection, demonstrating the avalanche property of hash functions. This catches accidental corruption — not deliberate forgery, which the leaked key makes trivial.
The authoritative Internet standard specifying the design and security proofs of HMAC.
Foundational essay on cryptography, open software, and mathematical privacy.