ZeroProof — Zero-Knowledge Authentication
A web-based zero-knowledge proof system. A user proves knowledge of a secret to a server without the secret — or anything derived from it that could reveal it — ever crossing the network.
The Problem
Conventional password authentication requires the client to transmit the secret, or a deterministic hash of it, to the server. The server therefore learns a value sufficient to impersonate the user, and any breach of its store compromises every account in it. ZeroProof removes the secret from the wire entirely: the server holds only a public commitment that is computationally infeasible to invert.
Required properties
Three properties are required of the proof system, and the choice of scheme is justified against them.
| Property | Meaning |
|---|---|
| Completeness | An honest prover who knows the secret always convinces the verifier |
| Soundness | A prover who does not know the secret convinces the verifier only with negligible probability |
| Zero-knowledge | The verifier's view can be simulated without the secret, so it leaks nothing |
Choice of scheme
ZeroProof uses a Schnorr proof of knowledge of a discrete logarithm, made non-interactive by the Fiat–Shamir transform. This was chosen over a zk-SNARK toolchain deliberately: a SNARK requires circuit compilation, a trusted setup ceremony and multi-megabyte proving keys, all of which add operational weight without changing what the system demonstrates. Schnorr is a genuine zero-knowledge proof with a short, auditable security argument, implementable in roughly 150 lines with no external dependencies, and it runs identically in a browser and on a server.
- p is the 2048-bit safe prime of RFC 3526 MODP Group 14
- g is 2, a generator of a large prime-order subgroup
- q is (p − 1) / 2, the subgroup order
- No trusted setup ceremony is required — the parameters are fixed and public
Registration
The secret never leaves the browser. The client generates a random 16-byte salt, derives a private exponent x from SHA-256 of the salt and secret modulo q, and computes the public commitment y as g^x mod p. Only the username, y and salt are posted to the server; x is discarded after use. Recovering x from y is the discrete logarithm problem in a 2048-bit group.
Proof of knowledge
At login the client requests a challenge, receiving a 128-bit server nonce with a 60-second expiry alongside the stored salt. It re-derives x from the typed secret, draws a single-use blinding factor, and produces a proof the server can verify against the stored commitment — learning nothing it could not have produced itself.
Implementation
Arithmetic uses native BigInt and hashing uses Web Crypto SHA-256, both of which exist in browsers and in the Node runtime, so one implementation serves prover and verifier with no duplicated cryptography.