Zero-Knowledge Proof authentication for APIs. The server never sees your secret.
Continuum Ghost is a protocol where the server never sees, stores, or transmits the client's secret. Authentication is based on Pedersen commitments and Schnorr/Sigma proofs over Ristretto255.
A database breach reveals only commitments — mathematical values that are useless without the client's secret.
| Package | Description | License |
|---|---|---|
@2fapi/protocol-spec |
Protocol specification: constants, types, interfaces | Apache 2.0 |
@2fapi/client-sdk |
Client SDK: ZK proof generation for browsers and Node.js | Apache 2.0 |
@2fapi/server |
Verification server (separate repo) | BSL 1.1 |
See the Getting Started Guide for a complete walkthrough: start the server, enroll a client, authenticate, and receive a token — with working curl commands.
- Registration: Client generates secret + blinding factor, computes Pedersen commitment
C = s·G + r·H, sends C to server - Challenge: Client requests a fresh nonce from the server
- Proof: Client generates a Sigma proof bound to the nonce
- Verification: Server verifies the proof against the stored commitment — without ever learning the secret
The crypto-core/ directory contains the Rust implementation of the cryptographic primitives:
- Ristretto255 group operations (via
curve25519-dalek) - Pedersen commitments
- Sigma/Schnorr proofs with Fiat-Shamir transform
- OPRF (Oblivious PRF, RFC 9497)
- Argon2id key derivation
- BIP-39 wordlist validation
- 2-of-2 additive secret sharing
- Constant-time operations throughout
Compiled to WASM for browser use and napi-rs for Node.js server use.
- 128-bit security under DLOG assumption on Ristretto255
- 28-pass internal red team audit, 109 findings, 0 open
- 1,940+ automated tests (TypeScript + Rust)
- Constant-time verification, timing-safe error responses
- OPRF-based credential derivation — offline brute-force impossible
- Perfect indistinguishability across all observable metrics
Protocol specification and client SDK are licensed under Apache 2.0.
The verification server is licensed under Business Source License 1.1 — free to self-host, converts to Apache 2.0 in 2030. See the server repo for details.
Copyright 2024-2026 Continuum Identity SAS.