Cryptographic Authentication

Broadly speaking, cryptographic authentication refers to recognizing an entity as one that is in possession of a secret cryptographic key. The entity may be a device containing the key, or a user owning such a device. Cryptographic authentication may encompass ascertaining the identity or some attributes of the device owner asserted by an authoritative third party, but more commonly refers to recognizing the user as a repeat visitor or as the owner of a previously established account.

Here we are concerned with cryptographic authentication to web applications by proof of possession of the private key component of a key pair. This zip file:

contains two applications that demonstrate the concept using the PJCL cryptographic library both on the client side and the server side:

  1. The web app app-mongodb.js is a proof-of-concept Node.js web app that shows how to use cryptographic authentication with a MongoDB database back-end.
  2. The web app app-nodb.js is a simpler Node.js app that has the same functionality and the same front-end as app-mongo-db.js but emulates the database using JavaScript objects.

These blog posts discuss in detail the login and registration processes used in app-mongodb.js:

An earlier cryptographic authentication demo can be found in the PJCL page.