Per-message authentication for ESP-IDF v6.0.x with a pre-shared installation key. Wraps a message in a 28-byte envelope (sender, receiver, epoch, counter, 128-bit HMAC-SHA256 tag) and rejects forged, altered, misaddressed and replayed messages. Pure logic on bytes: works over UDP, UART, BLE or anything else. PSA Crypto only, no encryption, no tasks, no allocations after create.