Broadly speaking, cryptographic authentication refers to recognizing an entity as one that is in possession of a secret cryptographic key. The entity may be a device containing the key, or a user owning such a device. Cryptographic authentication may encompass ascertaining the identity or some attributes of the device owner asserted by an authoritative third party, but more commonly refers to recognizing the user as a repeat visitor or as the owner of a previously established account.
Here we are concerned with cryptographic authentication to web applications by proof of possession of the private key component of a key pair. This zip file:
contains two applications that demonstrate the concept using the PJCL cryptographic library both on the client side and the server side:
- The web app app-mongodb.js is a proof-of-concept Node.js web app that shows how to use cryptographic authentication with a MongoDB database back-end.
These blog posts discuss in detail the login and registration processes used in app-mongodb.js:
- Cryptographic authentication with Node.js and MongoDB
- Credential Registration for Cryptographic Authentication with Node.js and MongoDB
An earlier cryptographic authentication demo can be found in the PJCL page.