Skip to content

Meteor-Auth (Device-Bound Authentication)

Choose a tag to compare

View all tags
@miosync-masa miosync-masa released this 28 Nov 01:58
· 417 commits to main since this release
V3.0.0
4a9d90f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

3.0.0 - 2025-11-21

🎉 Major Features

Meteor-Auth (Device-Bound Authentication)

The world's first passwordless, device-bound, quantum-resistant authentication system with full P2P integration.

Core Capabilities
  • Passwordless Login: QR code + device = authentication
  • Device Binding: Cryptographic keys tied to hardware (MAC, Platform, Processor)
  • Zero Server Trust: Server stores only 32-byte IDs (no passwords, no PII)
  • Quantum-Resistant: Built on Meteor-NC v2.0 (2^81,216 key space)
  • Built-in 2FA: Knowledge (seed) + Possession (device) = automatic two-factor authentication
Security Model
User Seed (32 bytes, Knowledge)
    +
Device Fingerprint (MAC/Platform, Possession)
    ↓
Device-Bound Seed (unique per device)
    ↓
Meteor ID (32-byte public identity)

Key Insight: Same user seed on different devices produces different Meteor IDs, enabling automatic device differentiation and preventing stolen seed attacks.

Authentication Flow
  1. Registration: User generates 32-byte seed (QR code compatible)
  2. Login: Device-bound key expansion (293ms average)
  3. Challenge: Server sends plaintext challenge
  4. Response: Client encrypts with device-bound key
  5. Verify: Server decrypts and validates (451ms full auth flow)
Features
  • QR Code Support: Export/import seeds as QR-compatible hex strings
  • Token Revocation: Instant peer removal and challenge cleanup
  • P2P Integration: Full Meteor-Protocol compatibility
  • Session Management: Metadata storage (username, email, etc.)
  • Bidirectional Trust: Client and server establish mutual P2P connection

✅ Validated

Device Binding Test

  • Scenario: Same seed used on two different devices
  • Result: Different Meteor IDs generated (security ✓)
  • Status: Stolen seeds proven useless on unauthorized devices

Performance Benchmarks

  • Login: 293ms ± 10ms (key expansion + P2P node creation)
  • Full Auth Flow: 451ms ± 15ms (login + P2P + challenge + verify)
  • Components:
    • Key expansion: 293ms
    • P2P setup: ~50ms
    • Challenge-response: ~100ms
    • Verification: instant

Token Revocation

  • Before Revocation: Authentication ✅ SUCCESS
  • After Revocation: Authentication ❌ BLOCKED (as expected)
  • Cleanup: Automatic peer removal and challenge deletion

QR Code Flow

  • Export: Seed → hex string (64 characters)
  • Import: Hex string → seed (100% match)
  • Login: Successful with imported seed

📦 New Files

  • meteor_auth.py - Core authentication framework

    • MeteorAuth - Client-side authentication
    • MeteorAuthServer - Server-side authentication
    • Device fingerprinting (MAC, Platform, Processor)
    • QR code export/import
    • Token management

  • meteor_auth_demo.py - Comprehensive demo suite

    • Basic authentication flow
    • Device binding demonstration
    • QR code workflow
    • Performance benchmarks
    • Token revocation test

🔧 Enhancements

meteor_protocol.py

  • Added remove_peer() method for peer cleanup
  • Enhanced peer management for authentication use cases

📚 Use Cases

Consumer Applications

  • Banking Apps: Mobile-first security with device binding
  • Social Media: "Login with Meteor" (passwordless)
  • E-commerce: Frictionless checkout authentication

Enterprise

  • BYOD/VPN: Device-aware access control
  • Internal Systems: Hardware-bound credentials
  • Cloud Services: Multi-device management

Web 4.0

  • Decentralized Identity: 32-byte portable identity
  • P2P Authentication: Serverless auth meshes
  • DAO Governance: Quantum-resistant voting

🔬 Technical Details

Device Fingerprinting

Components:
- MAC address (uuid.getnode())
- Platform (system, machine, version)
- Processor info
- SHA-256 hash → 32 bytes

Cryptographic Binding

device_bound_seed = SHA256(user_seed || device_fingerprint)
meteor_id = SHA256("METEOR_ID_v1" || device_bound_seed)

Storage Requirements (Server)

Per User:
- Meteor ID: 32 bytes
- Token: 64 bytes (hex)
- Metadata: JSON (optional, minimal)
Total: ~100 bytes/user

No passwords stored!

No personal information required!
<clipboard-copy aria-label="Copy" class="ClipboardButton btn btn-invisible js-clipboard-copy m-2 p-0 d-flex flex-justify-center flex-items-center" data-copy-feedback="Copied!" data-tooltip-direction="w" value="Per User:

  • Meteor ID: 32 bytes
  • Token: 64 bytes (hex)
  • Metadata: JSON (optional, minimal)
    Total: ~100 bytes/user

No passwords stored!
No personal information required!" tabindex="0" role="button" style="box-sizing: border-box; position: relative; display: flex !important; padding: 0px !important; font-size: 14px; font-weight: 500; line-height: 20px; white-space: nowrap; vertical-align: middle; cursor: pointer; user-select: none; border: 0px; border-radius: 6px; appearance: none; color: rgb(68, 147, 248); background-color: rgba(0, 0, 0, 0); box-shadow: none; transition: color 80ms cubic-bezier(0.33, 1, 0.68, 1), background-color, box-shadow, border-color; justify-content: center !important; align-items: center !important; margin: 8px !important; width: 28px; height: 28px;">

🆚 Comparison with Existing Systems

Feature OAuth 2.0 FIDO2/WebAuthn Meteor-Auth
Passwords Required Not required Not required
Server Storage Hash + salt Public key 32-byte ID only
Quantum Resistant No No Yes
Device Binding Optional Yes Built-in
P2P Compatible No No Yes
Setup Complexity High Medium Low
Phishing Resistant No Yes Yes
Stolen Credential Risk High Low Zero

🎯 Security Advantages

  1. Defense in Depth

    • Knowledge factor (seed)
    • Possession factor (device)
    • Quantum resistance (Meteor-NC)

  2. Zero Trust Architecture

    • Server never sees password
    • No PII storage required
    • Challenge-response validation only

  3. Perfect Forward Secrecy

    • Each device = unique identity
    • Compromised device ≠ account compromise
    • Revocation is instant and effective

  4. Phishing Immunity

    • No credentials to steal
    • Device-bound keys non-transferable
    • Server can't be fooled by replay attacks
3.0.0 - 2025-11-21
🎉 Major Features
Meteor-Auth (Device-Bound Authentication)
The world's first passwordless, device-bound, quantum-resistant authentication system with full P2P integration.

Core Capabilities
Passwordless Login: QR code + device = authentication
Device Binding: Cryptographic keys tied to hardware (MAC, Platform, Processor)
Zero Server Trust: Server stores only 32-byte IDs (no passwords, no PII)
Quantum-Resistant: Built on Meteor-NC v2.0 (2^81,216 key space)
Built-in 2FA: Knowledge (seed) + Possession (device) = automatic two-factor authentication
Security Model
User Seed (32 bytes, Knowledge)
+
Device Fingerprint (MAC/Platform, Possession)
↓
Device-Bound Seed (unique per device)
↓
Meteor ID (32-byte public identity)
Key Insight: Same user seed on different devices produces different Meteor IDs, enabling automatic device differentiation and preventing stolen seed attacks.

Authentication Flow
Registration: User generates 32-byte seed (QR code compatible)
Login: Device-bound key expansion (293ms average)
Challenge: Server sends plaintext challenge
Response: Client encrypts with device-bound key
Verify: Server decrypts and validates (451ms full auth flow)
Features
QR Code Support: Export/import seeds as QR-compatible hex strings
Token Revocation: Instant peer removal and challenge cleanup
P2P Integration: Full Meteor-Protocol compatibility
Session Management: Metadata storage (username, email, etc.)
Bidirectional Trust: Client and server establish mutual P2P connection
✅ Validated
Device Binding Test
Scenario: Same seed used on two different devices
Result: Different Meteor IDs generated (security ✓)
Status: Stolen seeds proven useless on unauthorized devices
Performance Benchmarks
Login: 293ms ± 10ms (key expansion + P2P node creation)
Full Auth Flow: 451ms ± 15ms (login + P2P + challenge + verify)
Components:
Key expansion: 293ms
P2P setup: ~50ms
Challenge-response: ~100ms
Verification: instant
Token Revocation
Before Revocation: Authentication ✅ SUCCESS
After Revocation: Authentication ❌ BLOCKED (as expected)
Cleanup: Automatic peer removal and challenge deletion
QR Code Flow
Export: Seed → hex string (64 characters)
Import: Hex string → seed (100% match)
Login: Successful with imported seed
📦 New Files
meteor_auth.py - Core authentication framework

MeteorAuth - Client-side authentication
MeteorAuthServer - Server-side authentication
Device fingerprinting (MAC, Platform, Processor)
QR code export/import
Token management
meteor_auth_demo.py - Comprehensive demo suite

Basic authentication flow
Device binding demonstration
QR code workflow
Performance benchmarks
Token revocation test
🔧 Enhancements
meteor_protocol.py
Added remove_peer() method for peer cleanup
Enhanced peer management for authentication use cases
📚 Use Cases
Consumer Applications
Banking Apps: Mobile-first security with device binding
Social Media: "Login with Meteor" (passwordless)
E-commerce: Frictionless checkout authentication
Enterprise
BYOD/VPN: Device-aware access control
Internal Systems: Hardware-bound credentials
Cloud Services: Multi-device management
Web 4.0
Decentralized Identity: 32-byte portable identity
P2P Authentication: Serverless auth meshes
DAO Governance: Quantum-resistant voting
🔬 Technical Details
Device Fingerprinting
Components:

  • MAC address (uuid.getnode())
  • Platform (system, machine, version)
  • Processor info
  • SHA-256 hash → 32 bytes
    Cryptographic Binding
    device_bound_seed = SHA256(user_seed || device_fingerprint)
    meteor_id = SHA256("METEOR_ID_v1" || device_bound_seed)
    Storage Requirements (Server)
    Per User:
  • Meteor ID: 32 bytes
  • Token: 64 bytes (hex)
  • Metadata: JSON (optional, minimal)
    Total: ~100 bytes/user

No passwords stored!
No personal information required!
🆚 Comparison with Existing Systems
Feature OAuth 2.0 FIDO2/WebAuthn Meteor-Auth
Passwords Required Not required Not required
Server Storage Hash + salt Public key 32-byte ID only
Quantum Resistant No No Yes
Device Binding Optional Yes Built-in
P2P Compatible No No Yes
Setup Complexity High Medium Low
Phishing Resistant No Yes Yes
Stolen Credential Risk High Low Zero
🎯 Security Advantages
Defense in Depth

Knowledge factor (seed)
Possession factor (device)
Quantum resistance (Meteor-NC)
Zero Trust Architecture

Server never sees password
No PII storage required
Challenge-response validation only
Perfect Forward Secrecy

Each device = unique identity
Compromised device ≠ account compromise
Revocation is instant and effective
Phishing Immunity

No credentials to steal
Device-bound keys non-transferable
Server can't be fooled by replay attacks

Assets 2
Loading