auth.js: Advanced Authentication for the Web

Abstract

Several research works attempt to replace simple authentication schemes, where the cryptographic digest of a plaintext password is stored at the server. Those proposals are based on more elaborate schemes, such as PAKE-based protocols. However, in practice, only a very limited amount of applications in the web use such schemes. The reason for this limited deployment is perhaps their complexity as far as the cryptography involved is concerned. Today, even the most successful web applications use text-based passwords, which are simply hashed and stored at the server. This has broad implications for both the service and the user. Essentially, the users are forced to reveal their plain passwords for both registering and authenticating with a service.

In this paper, we attempt to make it easier for any web service to a) enable easily advanced authentication schemes, and b) switch from one scheme to another. More precisely, we design and realize auth.js, a framework that allows a web application to offer advanced authentication that leverages sophisticated techniques compared to typical cryptographically hashed text-based passwords. In fact, auth.js can be easily enabled in all web applications and supports traditional passwords – however, once enabled, switching to a more elaborate scheme is straight forward. auth.js leverages advanced cryptographic primitives, which can be used for implementing strong authentication, such as PAKE and similar solutions, by ensuring that all cryptographic primitives are trusted and executed using the browser’s engine. For this, we extend Mozilla Crypto with more cryptographic primitives, such as scrypt and the edwards25519 elliptic curve. Finally, we evaluate auth.js with real web applications, such as WordPress.