Arken-Core Rust Library Introduces DID-Based Passwordless Authentication

Arken-core is an early-stage cryptographic Rust library designed to provide passwordless authentication through Decentralized Identifier (DID) signatures, according to GitHub documentation from the Arken Protocol project. The software relies on cryptographic verification rather than stored passwords or server sessions, aiming to eliminate traditional credential databases.

Core Technical Architecture

• Cryptographic Engine: Uses ECDSA secp256k1 signature verification via ethers-rs.
• Identity Standard: Implements W3C spec did:key identity using the `zQ3s…` prefix for secp256k1, deriving a consistent identity across any server running Arken.
• Challenge-Response Mechanism: Generates cryptographically random nonces with a 60-second Time-To-Live (TTL).
• Compilation and Distribution: Compiles to a native shared library (`.dylib`, `.so`, `.dll`) loaded by higher-level packages via Foreign Function Interface (FFI), exporting three C-compatible functions.

Authentication Flow

Unsigned requests receive a 401 status code accompanied by a one-time nonce. Clients sign this nonce using an secp256k1 private key and retry the request using an `Authorization: Signature` header. The core system verifies the signature and checks the nonce, returning the agent's `did:key` without storing session state.

Current Limitations and Status

Project maintainers state that the software is not yet production-ready and remains in an early stage:

• Nonces are stored in memory, meaning they will not survive server restarts or operate across multiple instances without a shared external store.
• There is no built-in key recovery mechanism; losing the private key results in permanent loss of access.
• Building the library requires the Rust toolchain, with prebuilt binaries scheduled for the 1.0 roadmap.

Verification and Roadmap

Developers can review the repository and the `SECURITY.md` file on GitHub to examine implementation details. The project invites security researchers to report flaws via private advisories. Additionally, the project documentation outlines a Founding Builders program for contributors joining before December 15, 2026, alongside ten design-partner slots for teams collaborating on API development.