Halo 2 Anonymous Authentication

Prove you are authorized without revealing who you are. ZK-powered anonymous auth for web apps.

Quick Start

import { Identity, Verifier } from 'halo2-anon-auth';

// CLIENT — create an identity and prove authorization
const identity = await Identity.create();
const proof = await identity.authorize('my-dao');
// Send proof.toJSON() to your server

// SERVER — verify the proof
const verifier = await Verifier.create(['my-dao']);
const result = await verifier.check(proof, 'my-dao');

console.log(result.authorized); // true — user is anonymous but authorized

That's it. No keypairs, no elliptic curves, no crypto. Just string IDs and opaque objects.

How It Works

1. Identity.create() generates a secret key and creates an anonymous identity
2. identity.authorize('my-dao') produces a zero-knowledge proof that the identity holds a valid authorization under that authority
3. verifier.check(proof, 'my-dao') verifies the proof cryptographically
4. The verifier learns only "this user is authorized" — nothing else

Under the hood this uses Halo 2 PLONK proofs, Poseidon hashes, and DarkFi's ZKVM. But you don't need to know that.

Client API

Create and manage identities

// Create a new anonymous identity
const identity = await Identity.create();

// Save to localStorage
localStorage.setItem('identity', identity.save());

// Restore later
const identity = Identity.load(localStorage.getItem('identity'));

Prove authorization

const proof = await identity.authorize('my-dao');
// → Authorization object (call proof.toJSON() to serialize)

// Send to server as JSON
await fetch('/api/auth', {
  body: JSON.stringify(proof.toJSON()),
});

Server API

Verify proofs

const verifier = await Verifier.create(['my-dao', 'admin-portal']);

// Add a new authority later
verifier.addAuthority('new-authority');

// Check a proof
const result = await verifier.check(proof, 'my-dao');
// → { authorized: true, level: 'basic' }
// → { authorized: false, reason: '...' }

// Revoke a proof (prevent reuse)
verifier.revoke(proof);

Restore proofs on the server

const json = JSON.parse(requestBody);
const proof = Authorization.fromJSON(json);
const result = await verifier.check(proof, 'my-dao');

Installation

npm install halo2-anon-auth

Building from Source

• Node.js 18+
• Rust (latest stable)
• wasm-pack

git clone https://codeberg.org/PatrickM123/halo2-anon-auth.git
cd halo2-anon-auth
npm install
npm run build

Low-Level API

Need full crypto access? The low-level AnonAuth API is still available:

import { createAnonAuth, AnonAccount, AuthLevel } from 'halo2-anon-auth';

const auth = createAnonAuth();
await auth.init();
// ... full control over keys, witnesses, circuit, etc.

See TECHNICAL.md for the complete low-level API reference.

Security

This is a security-critical cryptography project. The proof guarantees knowledge soundness, nullifier correctness, and freshness via unique nonces. Review TECHNICAL.md for cryptographic design, threat model, and deployment checklist.

Browser Support

• Chrome/Edge 90+
• Firefox 90+
• Safari 15+

License

GNU Affero General Public License v3.0