diff --git a/auth.proto b/auth.proto
index c5b1ba5..cd466bf 100644
--- a/auth.proto
+++ b/auth.proto
@@ -9,14 +9,10 @@ package proto;
 // against its current (and previous) pre-shared key and uses the
 // recovered identity to set up the tunnel session.
 message Auth {
-  // Stable client identifier. MUST be exactly nine bytes. The HMAC
-  // (field 3) covers (client_id || timestamp); any other length
-  // passes the wire and the HMAC verifies cleanly against the same
-  // non-nine-byte input on both sides, silently breaking the
-  // identity contract. Both sender and receiver MUST validate the
-  // length before computing or checking the HMAC. Not a UUID — the
-  // client generates it once per installation using a CSPRNG and
-  // persists it across launches.
+  // Stable client identifier, exactly nine raw UTF-8 bytes; signed
+  // by the HMAC together with timestamp. Not a UUID — the client
+  // generates it once per installation using a cryptographically
+  // secure RNG and persists it across launches.
   bytes client_id = 1;
 
   // Minutes since the project epoch (2024-01-01 UTC), used as a