npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

kineauth

v0.4.0

Published

Passwordless authentication using Bitcoin cryptography

Downloads

1

Readme

KINeAuth

Passwordless authentication using Bitcoin cryptography

Overview

BitAuth is a way to do secure, passwordless authentication using the cryptography in Bitcoin. Instead of using a shared secret, the client signs each request using a private key and the server checks to make sure the signature is valid and matches the public key.

Getting started

Install with Node.js:

npm install kineauth

Advantages over other authentication mechanisms

  • By signing each request, man in the middle attacks are impossible.
  • A nonce is part of the data signed, which prevents replay attacks.
  • The cryptography in Bitcoin is rock solid and is securing billions of dollars worth of bitcoins.
  • It uses elliptic curve cryptography which performs much better than RSA.
  • Because the private key is never revealed to the server, it does not need to be exchanged between the server and client over a side channel like in HMAC.

Technical Overview

BitAuth uses the same technology in Bitcoin. A public private key pair is created using elliptic curve secp256k1. The public SIN (System identification number), like a bitcoin address, is the RIPEMD 160, SHA256 hash of the public key. See https://en.bitcoin.it/wiki/Identity_protocol_v1 for complete details.

In each request, the client includes a nonce to prevent replay attacks. The client signs the full url with the request body concatenated if there is one. The signature is included in the x-signature header and the public key is included in the x-identity header.

The server verifies that the signature is valid and that it matches the identity (the public key). It then computes the SIN from the public key, and sees whether that SIN has access to the requested resource. The nonce is checked to make sure it is higher than the previously used nonce.

Technology is readily available

With the growing popularity of Bitcoin, there are already libraries written in many languages. Because BitAuth uses the same technology as Bitcoin, it is easy to start using BitAuth.

Problems with password authentication

  • Have to keep track of a separate password for every web service. People forget passwords, encouraging them to reuse passwords and opening themselves up to having multiple services compromised.
  • Brute force attacks on weak passwords.
  • Passwords may travel over plaintext
  • Passwords in databases being leaked
  • Phishing attacks to steal passwords

Passwordless based authentication across web services

With BitAuth, users can use the same, strong password to encrypt their keys and not worry about one service gaining access to another.

In the future, an identity system could be built around BitAuth keys where a user could create one key to represent an identity which could authenticate against multiple services.

In order for this to work, there would have to be a browser integration or plugin which would manage these identities and a Javascript API where websites could sign requests going to their website with the private key, but without exposing the private key to the third party sites.

There also needs to be a public place to store SIN's, preferably in a decentralized blockchain or datastore like namecoin. Key revocations could be stored here as well as reviews/feedback to build a reputation around an identity.

Examples

Example server

var express = require('express');
var bodyParser = require('body-parser');
var rawBody = require('../lib/middleware/rawbody');
var kineauth = require('../lib/middleware/kineauth');

var users = {
  'Tf7UNQnxB8SccfoyZScQmb34V2GdEtQkzDz': {name: 'Alice'},
  'Tf22EUFxHWh4wmA3sDuw151W5C5g32jgph2': {name: 'Bob'}
};

var pizzas = [];

var app = express();
app.use(rawBody);
app.use(bodyParser());


app.get('/user', kineauth, function(req, res) {
  if(!req.sin || !users[req.sin]) return res.send(401, {error: 'Unauthorized'});
  res.send(200, users[req.sin]);
});

app.post('/pizzas', kineauth, function(req, res) {
  if(!req.sin || !users[req.sin]) return res.send(401, {error: 'Unauthorized'});
  var pizza = req.body;
  pizza.owner = users[req.sin].name;
  pizzas.push(pizza);
  res.send(200, req.body);
});

app.get('/pizzas', function(req, res) {
  res.send(200, pizzas);
});

app.listen(3000);

Example client

var request = require('request');
var kineauth = require('../lib/kineauth');

// These can be generated with kineauth.generateSin()
var keys = {
  alice: '38f93bdda21a5c4a7bae4eb75bb7811cbc3eb627176805c1009ff2099263c6ad',
  bob: '09880c962437080d72f72c8c63a69efd65d086c9e7851a87b76373eb6ce9aab5'
};

// GET

for(k in keys) {
  var url = 'http://localhost:3000/user';
  var dataToSign = url;
  var options = {
    url: url,
    headers: {
      'x-identity': kineauth.getPublicKeyFromPrivateKey(keys[k]),
      'x-signature': kineauth.sign(dataToSign, keys[k])
    }
  };

  request.get(options, function(err, response, body) {
    if(err) {
      console.log(err);
    }
    if(body) {
      console.log(body);
    }
  });
}

var pizzas = ['pepperoni', 'sausage', 'veggie', 'hawaiian'];

// POST

for(k in keys) {
  var url = 'http://localhost:3000/pizzas';
  var data = {type: pizzas[Math.floor(Math.random() * pizzas.length)]};
  var dataToSign = url + JSON.stringify(data);
  var options = {
    url: url,
    headers: {
      'x-identity': kineauth.getPublicKeyFromPrivateKey(keys[k]),
      'x-signature': kineauth.sign(dataToSign, keys[k])
    },
    json: data
  };

  request.post(options, function(err, response, body) {
    if(err) {
      console.log(err);
    }
    if(body) {
      console.log(body);
    }
  });
}

Middleware

KINeAuth exposes a connect middleware for use in connect or ExpressJS applications. Use:

var kineauth = require('kineauth');
app.use( kineauth.middleware );