daku

DAKU

Anonymous authentication. Zero personal data.

DAKU (pronounced DAA KU) means "bandits" in Punjabi. Historically, bandits operated anonymously, often using masks to hide their identity. This library adopts that privacy-first ethos—anonymous cryptographic authentication without personal data.

Why DAKU?

Stop storing passwords. Stop managing email verifications. Stop worrying about data breaches.

DAKU is a simpler approach to user authentication that keeps both you and your users anonymous. No databases of usernames, no password hashes to secure, no personal information to leak.

// Traditional auth: Store emails, hash passwords, manage resets...
// DAKU: Just verify cryptographic signatures ✨
const publicKey = await verifyAuth(token);

The Problem with Traditional Auth

Every traditional authentication system carries risk:

• Passwords: Users reuse them, forget them, get them stolen
• Email/Phone: Requires collecting personal data (GDPR, privacy laws)
• Databases: Honeypots for hackers; one breach exposes everything
• Identity: Your users leave traces everywhere they sign up

The DAKU Way

Users authenticate with cryptographic keypairs—like Bitcoin wallets, but for your app:

• No signup forms: Generate a keypair, start using your app
• No passwords: Users never create or remember passwords
• No PII collection: No emails, phones, or personal data
• Built-in spam protection: Proof-of-work prevents abuse
• You stay clean: Nothing sensitive to store, nothing to breach

DAKU uses secp256k1 signatures (same as Bitcoin/Ethereum) with proof-of-work spam protection. Auth tokens expire in 1 minute. Users control their private keys, you just verify signatures.

Installation

npm install daku

Quick Start

import { generateKeyPair, createAuth, verifyAuth } from "daku";

// 1. User generates keypair (client-side)
const { privateKey, publicKey } = generateKeyPair();

// 2. Create auth token (client-side)
const token = await createAuth(privateKey);

// 3. Verify auth (server-side)
const publicKey = await verifyAuth(token);
// ✅ Authenticated! publicKey is the unique user ID

Core Functions

generateKeyPair()

Create a new identity

const { privateKey, publicKey } = generateKeyPair();

Generates a secp256k1 keypair. The privateKey stays with the user (never share it), the publicKey identifies them to your service.

• Returns: { privateKey: string, publicKey: string }
• Use case: First-time users, account creation

getPublicKey(privateKey)

Derive the public identity

const publicKey = getPublicKey(privateKey);

Extract the public key from a private key. Useful when users return with their saved privateKey.

• Returns: publicKey string
• Deterministic: Same privateKey always produces same publicKey

getUsername(publicKey)

Make public keys human-readable

const username = await getUsername(publicKey);
// → "happy-ocean-flows-1234"

Public keys are long hex strings. getUsername() converts them into memorable usernames for your UI.

• Returns: Human-readable username string
• Deterministic: Same publicKey always → same username
• Format: adjective-noun-verb-number

[!IMPORTANT]
Never ask users to create usernames. DAKU keeps users anonymous. Display the generated username in your UI, but always identify users by their publicKey in your database.

createAuth(privateKey, pow?)

Generate authentication token

const token = await createAuth(privateKey, 2); // pow = difficulty

Creates a signed auth token with timestamp, nonce, signature, and proof-of-work. Send this to your server for verification.

• Returns: Base64-encoded auth token
• Default POW: 2 (adjust for spam protection)
• Includes: timestamp, nonce, signature, proof-of-work

verifyAuth(token, pow?)

Verify authentication token

const publicKey = await verifyAuth(token, 2);
if (publicKey) {
  // ✅ Valid! User authenticated
  console.log(`User ${publicKey} logged in`);
} else {
  // ❌ Invalid or expired
}

Verifies the signature, proof-of-work, and timestamp (must be < 1 minute old). Returns the user's publicKey on success.

• Returns: publicKey string or null
• Checks: Signature validity, POW correctness, timestamp freshness
• Token lifetime: 1 minute

sign(message, privateKey, pow?)

Sign any message

const { signature, pow } = await sign("hello world", privateKey, 2);

Create a cryptographic signature for any message with proof-of-work. Lower-level function used by createAuth().

• Returns: { signature: string, pow: number }
• Use case: Custom message signing beyond authentication

verify(message, signatureData, publicKey, pow?)

Verify any signature

const isValid = await verify("hello world", { signature, pow }, publicKey, 2);

Verify a message signature and proof-of-work. Lower-level function used by verifyAuth().

• Returns: boolean
• Checks: Signature + POW validity

Express.js Middleware

import express from "express";
import { verifyAuth, getUsername } from "daku";

const app = express();

// Middleware: Verify DAKU auth
const daku =
  (powDifficulty = 2) =>
  async (req, res, next) => {
    const token = req.headers["daku"];
    const publicKey = await verifyAuth(token, powDifficulty);

    if (!publicKey) {
      return res.status(401).json({ error: "Unauthorized" });
    }

    req.userId = publicKey; // Attach user ID
    next();
  };

// Protected route
app.post("/api/profile", daku(), async (req, res) => {
  const username = await getUsername(req.userId);
  res.json({
    message: `Welcome, ${username}!`,
    userId: req.userId,
  });
});

app.listen(3000);

Key Benefits

Traditional Auth	DAKU
Manage passwords, hashes, resets	No passwords—just verify signatures
Store emails/phones (PII)	Zero personal data collected
User databases = security liability	Only store public keys (not sensitive)
Slow authentication flows	Instant cryptographic verification
GDPR compliance overhead	No PII = simpler compliance
Spam = manual moderation/CAPTCHAs	Built-in proof-of-work protection

Features

• 🕵️ Anonymous: No email, no phone, no personal data
• 🔐 Secure: secp256k1 signatures (Bitcoin/Ethereum-grade)
• 🛡️ Spam-proof: Configurable proof-of-work difficulty
• ⚡ Lightweight: Minimal dependencies, works everywhere
• 🌐 Universal: Node.js + Browser compatible
• ⏱️ Short-lived tokens: 1-minute expiration (anti-replay)
• 🌍 Cross-project identity: Reuse one keypair across apps

Global Identity

Users can reuse one private key across multiple services. Same privateKey → same publicKey → same identity everywhere.

// User's keypair works on yourapp.com AND anotherapp.com
const publicKey = getPublicKey(samePrivateKey);
// → Same publicKey = consistent cross-platform identity

[!WARNING]
Reusing keypairs links user identity across services. This enables seamless cross-app experiences but reduces anonymity between services. For per-app isolation, derive or generate separate keys.

Security Notes

• Private keys: Users must store them securely (localStorage, hardware wallets). Lost keys = lost access.
• Token lifetime: Hardcoded to 1 minute; prevent replay attacks.
• POW difficulty: Default = 2 leading zeros. Increase for high-traffic endpoints (trade-off: slower auth).
• No server secrets: DAKU has no shared secrets—everything is public-key cryptography.

DAKU: The authentication system that doesn't know anything about your users. By design.