Legion ZK Auth 🛡️

True Zero-Knowledge Authentication with Hardware-Bound Device Ring Signatures

🎯 What is Legion?

Legion is a zero-knowledge authentication system that proves you're authorized without revealing who you are. You prove something based on public data without linking your current action back to your public address.

Key Features

✅ True Zero-Knowledge: Server never learns your identity (1 of 1M users)
✅ Device Anonymity: Hardware-bound with ring signatures (1 of 1K devices)
✅ No Trusted Setup: Halo2 PLONK (transparent setup)
✅ Hardware Security: WebAuthn TPM/Secure Enclave binding
✅ Replay Protection: Nullifiers + timestamps
✅ Session Security: Linkability tags prevent theft
✅ Rate Limiting: 5 attempts/hour (generic errors prevent enumeration)
✅ Device Revocation: Block stolen devices instantly
✅ Works: Docker, systemd, monitoring included

🔒 Security Guarantees (v1.1.0)

Property	Guarantee
User Anonymity	1 of 2^20 (1,048,576)
Device Anonymity	1 of 2^10 (1,024)
Soundness Error	2^-128
Proof System	Halo2 PLONK
Password Hashing	Argon2id
Hardware Binding	WebAuthn Level 2
Rate Limiting	5 attempts/hour
Device Revocation	Instant blacklist

🚀 Quick Start (One Command!)

Prerequisites

Docker (includes Docker Compose)

Install & Run

# Clone and run
git clone https://github.com/deadends/legion.git
cd legion

# Linux/macOS
chmod +x install.sh && ./install.sh

# Windows
install.bat

That's it! Open http://localhost in your browser.

What Gets Installed

✅ Redis (session storage)
✅ Legion Server (ZK proof verifier)
✅ Frontend (WASM client)
✅ Nginx (reverse proxy)

Performance: Registration ~10s, Authentication ~4min (k=16 proof generation)

Manual Setup (Without Docker)

Click to expand manual installation

# 1. Install Redis
# macOS: brew install redis && redis-server
# Ubuntu: sudo apt install redis && redis-server
# Windows: https://redis.io/docs/install/install-redis/install-redis-on-windows/

# 2. Run server (terminal 1)
cd legion-server
cargo run --release --features redis

# 3. Build frontend (terminal 2)
cd wasm-client
wasm-pack build --target web --release
python3 -m http.server 8000

# 4. Open http://localhost:8000

For production deployment, see DEPLOYMENT.md

📊 Performance

Security Level	k	Proof Time	Proof Size	Use Case
Testing	12	~10s	2.5 KB	Development
Standard	14	~60s	3.0 KB	Staging
Production	16	~4min	3.5 KB	Recommended
High Security	18	~15min	4.0 KB	Enterprise

🏗️ Architecture

📖 For detailed step-by-step authentication flow with cryptographic details, see ARCHITECTURE_FLOW.md

legion

Most Popular