Hashcash-based authentication module using Web Crypto API
npm install pow-authA proof-of-work based authentication module using Web Crypto API.
- Hashcash-style proof of work authentication
- Configurable difficulty level
- Replay attack protection using LRU cache
- Time-based validation with configurable windows
- Built on Web Crypto API for secure cryptographic operations
``bash`
npm install pow-auth
`javascript
import { PowAuth } from 'pow-auth';
// Create a new instance with difficulty level 2 (requiring 2 leading zeros)
const auth = new PowAuth({
difficulty: 2,
timeWindow: 300000, // 5 minutes
timeTolerance: 60000, // 1 minute
maxCacheSize: 10000 // Maximum number of proofs to cache
});
// Generate a key from username and password
const key = await auth.generateKey('username', 'password');
// Generate a proof of work
const proof = await auth.generateProof('username', 'password');
// Verify the proof
const result = await auth.verifyProof(proof, key);
if (result.valid) {
console.log('Authentication successful');
} else {
console.log(Authentication failed: ${result.reason});`
}
Creates a new PowAuth instance.
#### Config Options
- difficulty: Number of leading zeros required for proof of worktimeWindow
- : Time window in milliseconds (default: 300000, 5 minutes)timeTolerance
- : Time tolerance in milliseconds (default: 60000, 1 minute)maxCacheSize
- : Maximum number of used proofs to store (default: 10000)
Generates a SHA-256 hash key from name and password.
Generates a proof of work based on the hashcash principle.
Returns a proof object containing:
- name: Usernamets
- : Timestampnonce
- : Nonce valuehash
- : Generated hash
Verifies a proof against a key.
Returns a result object containing:
- valid: Boolean indicating if proof is validcode
- : Status code ('OK' or error code)reason
- : Description of the result
#### Error Codes
- EXPIRED: Proof has expiredFUTURE_TIMESTAMP
- : Proof timestamp is too far in the futureREPLAY
- : Proof has already been usedINSUFFICIENT_DIFFICULTY
- : Hash does not meet difficulty requirementINVALID_HASH`: Hash verification failed
-
1. The difficulty level should be set based on your security requirements
2. Time windows should be adjusted based on your network latency expectations
3. Cache size should be set based on your expected traffic volume
MIT