Revisiting user registration and authentication
summary
Combines hashcash PoW with delta bits and Zero-Knowledge Password Proof (ZKPP) to harden registration and API endpoints: the server issues a nonce and a JWT containing a difficulty delta, clients brute-force nonces until the hash has the required leading zero bits (demo shows exponential solve time and a 5s timeout around difficulty 18), while ZKPP registers a salt and password verifier and performs ephemeral-key exchanges so no password ever leaves the client and a session key is established for subsequent encryption.
AI-written summary · about
chapters (8)
- 0:00Authentication challenges
- 1:10Proof of work vs zero knowledge
- 4:01Elliot the attacker
- 5:08Defending with proof of work and ZK password proof
- 6:34Rate limiting with proof of work
- 9:25Proof of work demo
- 11:39Zero knowledge password proof
- 13:25Security benefits and deployment
related talks
39mZen and the art of edge authentication
46mCracking JWT: a tale of magic, Node.JS and parallel computing
28mPasswordless zero-knowledge services
30mKnock, knock! Who's there?
34mSNARKs and their Practical Applications
29mTackling Authentication with Phoenix
27mBuilding Zero-Knowledge Backends
37mWhat ZK Can—and Can’t—Do for You