// Traditional password authentication (DANGEROUS)
app.post('/login', async (req, res) => {
  const { username, password } = req.body;
 
  // Password exists in plaintext in memory
  console.log('Password received:', password); // Logged!
 
  const user = await User.findOne({ username });
  const isValid = await bcrypt.compare(password, user.hashedPassword);
 
  if (isValid) {
    // Password was correct, but server saw it
    return res.json({ token: generateJWT(user.id) });
  }
 
  res.status(401).json({ error: 'Invalid credentials' });
});

# Generate SSH key pair
ssh-keygen -t ed25519 -C "your_email@example.com"
 
# Copy public key to server
ssh-copy-id user@server.com
 
# Authenticate without sending private key
ssh user@server.com

// Pedagogical concept: Password → Deterministic Key Generation
// ⚠️ This simplified example has security flaws - see warnings above
class PedagogicalPasswordToKeys {
    async generateKeyPair(password, userIdentifier) {
        // Step 1: Create deterministic seed from password + user ID
        const encoder = new TextEncoder();
        const passwordBytes = encoder.encode(password);
 
        // Step 2: Generate a proper random salt (stored per-user)
        // ❌ SECURITY FLAW: In this example we use a predictable salt
        // ✅ PRODUCTION: Use crypto.getRandomValues(new Uint8Array(32)) and store it
        const predictableSalt = encoder.encode('demo-salt-' + userIdentifier);
 
        // Step 3: Use memory-hard key derivation
        const keyMaterial = await crypto.subtle.importKey(
            'raw',
            passwordBytes,
            { name: 'PBKDF2' },
            false,
            ['deriveKey']
        );
 
        // Derive a symmetric key first
        const derivedKey = await crypto.subtle.deriveKey(
            {
                name: 'PBKDF2',
                salt: predictableSalt,
                iterations: 100000,  // ⚠️ Production should use 500k+ or Argon2id
                hash: 'SHA-256'
            },
            keyMaterial,
            { name: 'AES-GCM', length: 256 },
            true,
            ['encrypt', 'decrypt']
        );
 
        // Step 4: Use derived key as seed for deterministic keypair generation
        // ❌ SECURITY FLAW: This is a simplified demonstration
        // ✅ PRODUCTION: Use libraries like libsodium with crypto_sign_seed_keypair
        const keyBytes = await crypto.subtle.exportKey('raw', derivedKey);
 
        // For demo: hash the derived key to create a "deterministic" seed
        const seedHash = await crypto.subtle.digest('SHA-256', keyBytes);
 
        // ❌ SECURITY FLAW: We still use generateKey() which is random
        // This is for demonstration only - real implementations need seeded generation
        const keyPair = await crypto.subtle.generateKey(
            { name: 'ECDSA', namedCurve: 'P-256' },
            true,
            ['sign', 'verify']
        );
 
        // Store the seed for comparison (normally you'd use it for actual key generation)
        keyPair._deterministicSeed = Array.from(new Uint8Array(seedHash));
 
        return keyPair;
    }
 
    async compareSeeds(keyPair1, keyPair2) {
        // Compare the deterministic seeds (not the actual keys)
        const seed1 = keyPair1._deterministicSeed?.join(',');
        const seed2 = keyPair2._deterministicSeed?.join(',');
        return seed1 === seed2;
    }
}
 
// Usage example showing the concept
const keyGen = new PedagogicalPasswordToKeys();
const keyPair1 = await keyGen.generateKeyPair('mypassword123', 'user@example.com');
const keyPair2 = await keyGen.generateKeyPair('mypassword123', 'user@example.com');
 
// Same password = Same deterministic seed (concept demonstration)
console.log('Seeds match:', await keyGen.compareSeeds(keyPair1, keyPair2)); // true
 
// ❌ This comparison fails due to Web Crypto limitations:
console.log('Actual keys match:', keyPair1.privateKey === keyPair2.privateKey); // false
console.log('^ This is why production systems need proper libraries like libsodium');

class PasswordBasedAuthentication {
    constructor() {
        this.userPublicKeys = new Map(); // Server storage
    }
 
    // Registration: Store public key (derived from password)
    async register(username, password) {
        const keyPair = await this.generateKeyPair(password, username);
 
        // Server stores only the public key
        this.userPublicKeys.set(username, keyPair.publicKey);
 
        console.log('✅ Registered user without storing password');
        return { success: true };
    }
 
    // Authentication: Challenge-response without password transmission
    async authenticate(username, password) {
        const storedPublicKey = this.userPublicKeys.get(username);
        if (!storedPublicKey) {
            // ❌ SECURITY ISSUE: This reveals if username exists (client enumeration)
            // Real implementations must use constant-time responses
            return { success: false, error: 'User not found' };
        }
 
        // Step 1: Server generates random challenge
        const challenge = crypto.getRandomValues(new Uint8Array(32));
 
        // Step 2: User regenerates private key from password
        const keyPair = await this.generateKeyPair(password, username);
 
        // Step 3: User signs challenge with private key
        const signature = await crypto.subtle.sign(
            { name: 'ECDSA', hash: 'SHA-256' },
            keyPair.privateKey,
            challenge
        );
 
        // Step 4: Server verifies signature with stored public key
        const isValid = await crypto.subtle.verify(
            { name: 'ECDSA', hash: 'SHA-256' },
            storedPublicKey,
            signature,
            challenge
        );
 
        return {
            success: isValid,
            message: isValid ? '✅ Authenticated without password transmission' : '❌ Invalid credentials'
        };
    }
 
    async generateKeyPair(password, username) {
        // Same deterministic generation as above
        return await new PasswordToKeys().generateKeyPair(password, username);
    }
}
 
// Demo usage
const auth = new PasswordBasedAuthentication();
 
// Register user
await auth.register('alice@example.com', 'mySecurePassword123');
 
// Authenticate user (password never sent to server)
const result = await auth.authenticate('alice@example.com', 'mySecurePassword123');
console.log(result.message); // ✅ Authenticated without password transmission

// Traditional (DANGEROUS)
POST /login
{
    "username": "alice@example.com",
    "password": "mySecurePassword123"  // ❌ Password sent in plaintext
}
 
// Deterministic Key Generation (SECURE)
POST /login
{
    "username": "alice@example.com",
    "signature": "3045022100a7b3c2d1..."  // ✅ Cryptographic proof only
}

// Problems with our simple approach:
class SecurityLimitations {
    async demonstrateIssues() {
        // 1. CLIENT ENUMERATION
        // Server can tell if a username exists by checking for stored public key
        const userExists = this.userPublicKeys.has('alice@example.com');
        console.log('User exists:', userExists); // ❌ Privacy leak
 
        // 2. NO MUTUAL AUTHENTICATION
        // Client has no way to verify they're talking to the legitimate server
        // Vulnerable to server impersonation attacks
 
        // 3. LIMITED FORWARD SECRECY
        // If private key derivation is compromised, all past sessions at risk
 
        // 4. DICTIONARY ATTACKS ON WEAK PASSWORDS
        // Attacker with public key can attempt password guessing offline
        const weakPassword = 'password123';
        const guessedKeyPair = await this.generateKeyPair(weakPassword, 'alice@example.com');
        // If this matches stored public key, attacker found the password
    }
}

// Evolution comparison:
const AUTHENTICATION_EVOLUTION = {
    traditional: {
        security: '❌ Server sees password',
        privacy: '❌ Passwords stored on server',
        attacks: '❌ Vulnerable to breaches'
    },
 
    simpleKeyGeneration: {
        security: '✅ Password never transmitted',
        privacy: '⚠️  Can enumerate users',
        attacks: '⚠️  Vulnerable to sophisticated attacks'
    },
 
    opaque: {
        security: '✅✅✅ Password never exists on server',
        privacy: '✅✅✅ Cannot enumerate users',
        attacks: '✅✅✅ Resistant to advanced attacks'
    }
};

// Simple approach problem:
if (!this.userPublicKeys.has(username)) {
    return { error: 'User not found' }; // ❌ Reveals user existence
}
 
// OPAQUE solution: Oblivious Pseudo-Random Function (OPRF)
class OPAQUEClientEnumerationPrevention {
    async processCredentialRequest(username, blindedElement) {
        // Server ALWAYS processes the request, regardless of user existence
        // OPRF evaluation looks identical for existing/non-existing users
        const oprfResult = await this.evaluateOPRF(blindedElement);
 
        // For non-existent users, generate fake but indistinguishable response
        if (!this.hasUser(username)) {
            return this.generateFakeCredentialResponse(oprfResult);
        }
 
        return this.generateRealCredentialResponse(oprfResult, username);
    }
 
    // Key insight: Server responses are computationally indistinguishable
    // Attacker cannot tell if user exists from server's response
}

// Simple approach problem:
// Client has no way to verify server authenticity
 
// OPAQUE solution: Mutual authentication in 3-message exchange
class OPAQUEMutualAuthentication {
    async authenticateWithMutualVerification() {
        // Message 1: Client Credential Request
        const clientRequest = await this.createCredentialRequest(password);
 
        // Message 2: Server Credential Response + Server Authentication
        const serverResponse = await this.createAuthenticatedResponse(
            clientRequest,
            this.serverPrivateKey,    // Server proves its identity
            this.serverIdentity       // Server's certified identity
        );
 
        // Message 3: Client verifies server + completes authentication
        const authResult = await this.verifyServerAndCompleteAuth(
            serverResponse,
            this.expectedServerIdentity // Client verifies server
        );
 
        // Both client AND server are now authenticated
        return {
            sessionKey: authResult.sessionKey,
            serverVerified: authResult.serverAuthenticated, // ✅ Server proven
            clientAuthenticated: authResult.clientAuthenticated // ✅ Client proven
        };
    }
}

// Simple approach problem:
// Same derived keys used for all sessions
 
// OPAQUE solution: Fresh ephemeral keys per session
class OPAQUEForwardSecrecy {
    async generateSessionWithForwardSecrecy() {
        // Step 1: Generate ephemeral keypairs for this session only
        const clientEphemeralKeys = await this.generateEphemeralKeyPair();
        const serverEphemeralKeys = await this.generateEphemeralKeyPair();
 
        // Step 2: Derive session key from ephemeral + long-term secrets
        const sessionKey = await this.deriveSessionKey({
            clientEphemeral: clientEphemeralKeys.privateKey,
            serverEphemeral: serverEphemeralKeys.publicKey,
            clientLongTerm: this.recoveredClientPrivateKey,
            serverLongTerm: this.serverPublicKey
        });
 
        // Step 3: Immediately delete ephemeral private keys
        await this.secureDelete(clientEphemeralKeys.privateKey);
        await this.secureDelete(serverEphemeralKeys.privateKey);
 
        return {
            sessionKey: sessionKey,
            // ✅ Past sessions remain secure even if long-term keys compromised
            forwardSecurityGuarantee: 'ephemeral-keys-deleted'
        };
    }
}

// Simple approach problem:
// Attacker with public key can try passwords offline
async function offlineDictionaryAttack(storedPublicKey, userIdentifier) {
    const commonPasswords = ['password123', 'admin', '123456', 'qwerty'];
 
    for (const guess of commonPasswords) {
        const guessedKeyPair = await generateKeyPair(guess, userIdentifier);
        if (publicKeysMatch(guessedKeyPair.publicKey, storedPublicKey)) {
            return { found: true, password: guess }; // ❌ Password cracked
        }
    }
}
 
// OPAQUE solution: OPRF prevents offline attacks completely
class OPAQUEOfflineAttackPrevention {
    attemptOfflineAttack(credentialRecord) {
        // Attacker has: { envelope, server_public_key, oprf_record }
        // But CANNOT perform offline dictionary attack because:
 
        const commonPasswords = ['password123', 'admin', '123456'];
 
        for (const guess of commonPasswords) {
            // Step 1: Try to evaluate OPRF on password guess
            // ❌ IMPOSSIBLE: Requires server's OPRF private key
            // const oprfOutput = this.oprf.evaluate(guess, oprfPrivateKey);
 
            // Step 2: Even if they had OPRF output, envelope decryption requires:
            // - Correct OPRF output (which they can't compute)
            // - Knowledge of encryption parameters
            // const decryptedKey = this.decryptEnvelope(envelope, oprfOutput);
 
            console.log('❌ Cannot evaluate OPRF without server interaction');
        }
 
        return {
            attackSuccessful: false,
            reason: 'OPRF evaluation requires server\'s private OPRF key - offline attacks impossible',
            contrast: 'Traditional hashing allows offline brute force with stolen hashes'
        };
    }
 
    demonstrateOprfSecurity() {
        // OPRF security properties:
        return {
            'Oblivious': 'Server learns nothing about the password input',
            'Pseudorandom': 'Output looks random without the server key',
            'Deterministic': 'Same password always produces same output',
            'Unpredictable': 'Cannot guess output without server\'s secret key'
        };
    }
}

import hashlib
import secrets
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
 
class SimpleZKPasswordProof:
    def __init__(self):
        self.salt = secrets.token_bytes(32)
 
    def register_password(self, password: str) -> bytes:
        """User registration - creates a commitment to the password"""
        # Derive a key from the password
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=self.salt,
            iterations=100000,
        )
        password_key = kdf.derive(password.encode())
 
        # Create a commitment to the password
        nonce = secrets.token_bytes(16)
        commitment = hashlib.sha256(password_key + nonce).digest()
 
        # Store commitment and nonce (not the password!)
        return {
            'commitment': commitment,
            'nonce': nonce,
            'salt': self.salt
        }
 
    def prove_password_knowledge(self, password: str, stored_data: dict) -> dict:
        """Generate proof of password knowledge without revealing it"""
        # Derive the same key from password
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=stored_data['salt'],
            iterations=100000,
        )
        password_key = kdf.derive(password.encode())
 
        # Generate challenge response
        challenge = secrets.token_bytes(32)
        response = hashlib.sha256(password_key + challenge).digest()
 
        return {
            'challenge': challenge,
            'response': response,
            'nonce': stored_data['nonce']
        }
 
    def verify_proof(self, proof: dict, stored_data: dict) -> bool:
        """Verify the proof without learning the password"""
        # Reconstruct what the response should be
        expected_key_hash = hashlib.sha256(
            stored_data['commitment'] + proof['nonce']
        ).digest()
 
        # This is a simplified version - real protocols are more complex
        return proof['response'] == expected_key_hash
 
# Usage example
zk_auth = SimpleZKPasswordProof()
 
# Registration
password = "my_secure_password123"
stored_data = zk_auth.register_password(password)
print("Stored data (no password!):", stored_data.keys())
 
# Authentication
proof = zk_auth.prove_password_knowledge(password, stored_data)
is_valid = zk_auth.verify_proof(proof, stored_data)
print("Authentication successful:", is_valid)

// RFC 9807 OPAQUE Registration Implementation
class RFC9807Registration {
    constructor() {
        // RFC 9807 recommended configuration: ristretto255-SHA512
        this.cipherSuite = {
            group: 'ristretto255',
            hash: 'SHA512',
            kdf: 'HKDF-SHA512',
            mac: 'HMAC-SHA512',
            ksfId: 'Identity' // Key Stretching Function
        };
    }
 
    async registerClient(password, serverIdentity, clientIdentity) {
        // Step 1: Client initiates registration request
        const registrationRequest = await this.createRegistrationRequest(password);
 
        // Step 2: Server processes request and returns response
        const registrationResponse = await this.createRegistrationResponse(
            registrationRequest,
            serverIdentity,
            clientIdentity
        );
 
        // Step 3: Client finalizes registration
        const registrationRecord = await this.finalizeRegistrationRequest(
            registrationResponse,
            password,
            serverIdentity,
            clientIdentity
        );
 
        return {
            credentialFile: registrationRecord.credentialFile, // Stored on server
            exportKey: registrationRecord.exportKey,           // For app use
            clientPrivateKey: registrationRecord.clientPrivateKey // Client keeps
        };
    }
 
    async createRegistrationRequest(password) {
        // RFC 9807 Section 5.1.1: Client Registration Request
 
        // Generate random blind element
        const blind = await this.generateRandomScalar();
 
        // Blind the password for OPRF
        const blindedElement = await this.blindPassword(password, blind);
 
        return {
            request: blindedElement,
            blind: blind // Client keeps this secret
        };
    }
 
    async createRegistrationResponse(request, serverIdentity, clientIdentity) {
        // RFC 9807 Section 5.1.2: Server Registration Response
 
        // Server's OPRF private key (unique per server)
        const oprfPrivateKey = await this.getOrGenerateOprfKey();
 
        // Evaluate OPRF on blinded element
        const evaluatedElement = await this.oprfEvaluate(
            oprfPrivateKey,
            request.request
        );
 
        // Generate server keypair for this client
        const serverKeyPair = await this.generateKeyPair();
 
        return {
            evaluatedElement: evaluatedElement,
            serverPublicKey: serverKeyPair.publicKey,
            // Note: Server never sees the actual password
        };
    }
}

// RFC 9807 Section 6: Online Authenticated Key Exchange
class RFC9807Authentication {
    async authenticateUser(password, credentialFile, serverIdentity, clientIdentity) {
        // Message 1: Client Credential Request
        const credentialRequest = await this.createCredentialRequest(
            password,
            serverIdentity,
            clientIdentity
        );
 
        // Message 2: Server Credential Response
        const credentialResponse = await this.createCredentialResponse(
            credentialRequest,
            credentialFile,
            serverIdentity,
            clientIdentity
        );
 
        // Message 3: Client Key Exchange
        const keyExchangeResult = await this.recoverCredentials(
            credentialResponse,
            password,
            serverIdentity,
            clientIdentity
        );
 
        return {
            sessionKey: keyExchangeResult.sessionKey,     // For secure communication
            exportKey: keyExchangeResult.exportKey,       // For application use
            serverMac: keyExchangeResult.serverMac        // Server authentication
        };
    }
 
    async createCredentialRequest(password, serverIdentity, clientIdentity) {
        // RFC 9807 Section 6.1.1: Client Credential Request
 
        // Generate fresh randomness for this authentication
        const clientNonce = await this.generateRandomBytes(32);
 
        // Create blinded password element (like in registration)
        const blind = await this.generateRandomScalar();
        const blindedElement = await this.blindPassword(password, blind);
 
        // Generate client keypair for this session
        const clientKeyPair = await this.generateKeyPair();
 
        return {
            request: blindedElement,
            clientNonce: clientNonce,
            clientPublicKey: clientKeyPair.publicKey,
            // Client keeps: blind, clientPrivateKey
        };
    }
 
    async createCredentialResponse(credentialRequest, credentialFile,
                                 serverIdentity, clientIdentity) {
        // RFC 9807 Section 6.1.2: Server Credential Response
 
        // Evaluate OPRF on client's blinded element
        const evaluatedElement = await this.oprfEvaluate(
            this.oprfPrivateKey,
            credentialRequest.request
        );
 
        // Generate fresh server keypair for this session
        const serverKeyPair = await this.generateKeyPair();
 
        // Create authenticated response with credential file
        const response = await this.createAuthenticatedResponse(
            evaluatedElement,
            credentialFile,
            credentialRequest.clientPublicKey,
            serverKeyPair.publicKey,
            serverIdentity,
            clientIdentity
        );
 
        return {
            evaluatedElement: evaluatedElement,
            serverPublicKey: serverKeyPair.publicKey,
            serverNonce: response.serverNonce,
            maskedResponse: response.maskedResponse, // Encrypted credential info
            // Server keeps: serverPrivateKey for final key derivation
        };
    }
 
    async recoverCredentials(credentialResponse, password,
                           serverIdentity, clientIdentity) {
        // RFC 9807 Section 6.1.3: Client Credential Recovery
 
        // Unblind the OPRF result to get password-derived key
        const oprfOutput = await this.unblindOprfResult(
            credentialResponse.evaluatedElement,
            this.blind // From credential request
        );
 
        // Derive the same key used during registration
        const passwordDerivedKey = await this.derivePasswordKey(oprfOutput);
 
        // Decrypt the masked response to recover credentials
        const credentials = await this.decryptMaskedResponse(
            credentialResponse.maskedResponse,
            passwordDerivedKey
        );
 
        // Perform authenticated key exchange
        const sharedSecrets = await this.deriveSharedSecrets(
            credentials.clientPrivateKey,
            credentialResponse.serverPublicKey,
            this.clientPrivateKey, // From credential request
            credentials.serverPublicKey // From registration
        );
 
        return {
            sessionKey: sharedSecrets.sessionKey,
            exportKey: sharedSecrets.exportKey,
            serverMac: sharedSecrets.serverMac
        };
    }
}

// Cloudflare-style OPAQUE integration
class CloudflareOpaque {
    constructor() {
        // Uses standardized OPAQUE from IETF draft
        this.opaque = new OPAQUE({
            suite: 'P256-SHA256-HKDF-SHA256-HMAC-SHA256',
            ksf: 'Identity' // Key Stretching Function
        });
    }
 
    async registerUser(email, password) {
        // Step 1: Client initiates registration
        const registrationRequest = await this.opaque.createRegistrationRequest(
            password
        );
 
        // Step 2: Server processes request
        const registrationResponse = await this.processRegistrationRequest(
            registrationRequest,
            email
        );
 
        // Step 3: Client finalizes registration
        const registrationRecord = await this.opaque.finalizeRegistrationRequest(
            registrationResponse,
            password,
            email
        );
 
        // Step 4: Store record (no password information)
        await this.storeUserRecord(email, registrationRecord);
 
        console.log('User registered without password touching server');
    }
 
    async authenticateUser(email, password) {
        const credentialRequest = await this.opaque.createCredentialRequest(
            password
        );
 
        const credentialResponse = await this.processCredentialRequest(
            credentialRequest,
            email
        );
 
        const authResult = await this.opaque.recoverCredentials(
            credentialResponse,
            password,
            email
        );
 
        return authResult.sessionKey; // Shared secret for session
    }
}

class ThreatModelAnalysis {
    analyzeAttackScenarios() {
        return {
            // Scenario 1: Complete Database Breach
            databaseBreach: {
                traditional: {
                    impact: 'HIGH - Offline cracking possible',
                    timeToCompromise: 'Hours to days with GPU farms',
                    prevention: 'Strong hashing (Argon2id) only delays attacks'
                },
                opaque: {
                    impact: 'MINIMAL - OPRF records cannot be used offline',
                    timeToCompromise: 'Impossible without server OPRF key',
                    prevention: 'OPRF mathematically prevents offline evaluation'
                }
            },
 
            // Scenario 2: Server Infrastructure Compromise
            serverCompromise: {
                traditional: {
                    impact: 'CRITICAL - Passwords intercepted during auth',
                    scope: 'All future authentications compromised',
                    detection: 'Difficult - passwords look legitimate'
                },
                opaque: {
                    impact: 'LIMITED - No passwords to intercept',
                    scope: 'Only active sessions during compromise window',
                    detection: 'OPRF messages detectable if monitored'
                }
            },
 
            // Scenario 3: Targeted User Attacks
            userTargeting: {
                traditional: {
                    userEnumeration: 'Easy - different responses for valid/invalid users',
                    focusedAttacks: 'Possible - target specific user password hash',
                    scalability: 'Scales to full database offline attack'
                },
                opaque: {
                    userEnumeration: 'Prevented - constant-time indistinguishable responses',
                    focusedAttacks: 'Requires server interaction - rate limited',
                    scalability: 'Cannot scale - each guess requires server'
                }
            },
 
            // Scenario 4: Network-Level Attacks
            networkAttacks: {
                traditional: {
                    manInTheMiddle: 'Critical - passwords captured',
                    certificateCompromise: 'Passwords exposed during window',
                    networkLogging: 'Passwords visible in network traces'
                },
                opaque: {
                    manInTheMiddle: 'Limited - no passwords to capture',
                    certificateCompromise: 'OPRF messages only - no direct password exposure',
                    networkLogging: 'Cryptographic messages only'
                }
            }
        };
    }
 
    // OPAQUE-specific security properties
    getOpaqueSecurityGuarantees() {
        return {
            passwordPrivacy: {
                property: 'Server learns no information about the password',
                mechanism: 'OPRF provides oblivious evaluation',
                standard: 'Proven secure under DDH assumption (RFC 9807)'
            },
 
            offlineAttackResistance: {
                property: 'Attackers cannot test password guesses offline',
                mechanism: 'OPRF evaluation requires server private key',
                implication: 'Forces online attacks which can be rate-limited'
            },
 
            userEnumerationResistance: {
                property: 'Server responses for existing/non-existing users are indistinguishable',
                mechanism: 'Constant-time fake OPRF evaluation for non-existing users',
                standard: 'RFC 9807 Section 9.5 requirement'
            },
 
            mutualAuthentication: {
                property: 'Both client and server prove their identity',
                mechanism: '3DH authenticated key exchange',
                benefit: 'Prevents server impersonation attacks'
            },
 
            forwardSecrecy: {
                property: 'Past sessions remain secure even if long-term keys are compromised',
                mechanism: 'Ephemeral keys deleted after each session',
                guarantee: 'Perfect forward secrecy'
            },
 
            exportKeyDerivation: {
                property: 'Additional application keys derived securely',
                mechanism: 'HKDF with domain separation',
                useCase: 'Application-specific encryption without password exposure'
            }
        };
    }
}

const ATTACK_SURFACE_COMPARISON = {
    traditional: {
        serverSideSecrets: ['password_hashes', 'salts', 'pepper_keys'],
        networkExposure: ['plaintext_passwords', 'timing_patterns'],
        offlineAttackVectors: ['hash_cracking', 'rainbow_tables', 'dictionary_attacks'],
        enumerationVectors: ['response_timing', 'error_messages', 'database_queries'],
        impersonationRisk: 'high' // Server can be impersonated
    },
 
    opaque: {
        serverSideSecrets: ['oprf_private_key', 'server_private_keys'], // Minimal
        networkExposure: ['oprf_messages_only'], // No passwords
        offlineAttackVectors: [], // None possible
        enumerationVectors: [], // Provably prevented
        impersonationRisk: 'minimal' // Mutual authentication
    },
 
    riskReduction: {
        passwordExposure: '100%', // Complete elimination
        offlineAttacks: '100%',   // Mathematically impossible
        userEnumeration: '100%',  // Cryptographically prevented
        serverImpersonation: '90%' // 3DH provides strong mutual auth
    }
};

// Traditional database breach impact
const breachedData = {
    username: "user@example.com",
    passwordHash: "$2b$10$rBV2/NjJG.3SJUFtgX0qHOGqSyIHqNZAUGOJUIRGhN1vAqG9AOqsq",
    salt: "randomsalt123"
};
// Attackers can perform offline attacks on this hash
 
// OPAQUE breach impact
const opaqueBreachedData = {
    username: "user@example.com",
    envelope: "encrypted_blob_containing_private_key",
    publicKey: "user_public_key"
};
// Attackers get encrypted data useless without the password
// which never existed on the server

// What attackers CAN'T do with OPAQUE
class AttackPrevention {
    impossibleAttacks() {
        // ❌ Cannot intercept passwords during authentication
        // ❌ Cannot perform offline dictionary attacks
        // ❌ Cannot recover passwords from database dumps
        // ❌ Cannot see passwords in server logs
        // ❌ Cannot access passwords through admin interfaces
 
        console.log('Password never exists on server in any form');
    }
 
    // What they still can do (and how to prevent it)
    possibleAttacks() {
        // ⚠️ Client-side attacks (keyloggers, malware)
        // ⚠️ Phishing attacks
        // ⚠️ Social engineering
        //
        // Mitigation: Multi-factor authentication, education
    }
}

// Performance comparison (approximate)
class PerformanceAnalysis {
    async traditionalAuth(password) {
        const start = performance.now();
        await bcrypt.compare(password, hashedPassword);
        const end = performance.now();
 
        console.log(`Traditional auth: ${end - start}ms`);
        // ~10-100ms depending on bcrypt rounds
    }
 
    async zkAuth(password) {
        const start = performance.now();
        await opaque.authenticate(password, userRecord);
        const end = performance.now();
 
        console.log(`ZK auth: ${end - start}ms`);
        // ~100-500ms for full OPAQUE protocol
    }
}

// Required browser features
const browserRequirements = {
    webCrypto: 'crypto.subtle API for cryptographic operations',
    ecdh: 'Elliptic Curve Diffie-Hellman support',
    hkdf: 'HMAC-based Key Derivation Function',
    modernTLS: 'TLS 1.3 for secure channel establishment'
};
 
// Feature detection
function checkBrowserSupport() {
    const hasWebCrypto = 'crypto' in window && 'subtle' in window.crypto;
    const hasTLS13 = /* complex TLS version detection */;
 
    return hasWebCrypto && hasTLS13;
}

class MigrationStrategy {
    async migrateUsers() {
        // Option 1: Gradual migration on next login
        for (const user of existingUsers) {
            if (user.nextLoginAfter(migrationDate)) {
                await this.upgradeToOpaque(user);
            }
        }
 
        // Option 2: Force password reset for security
        await this.sendPasswordResetEmails();
 
        // Option 3: Dual authentication support
        await this.supportBothMethods();
    }
}

import { Opaque } from '@cloudflare/opaque-ts';
 
const opaque = new Opaque();
// Production-ready OPAQUE implementation

from libopaque import OPAQUE
 
# High-performance native implementation
opaque = OPAQUE()

import "github.com/cloudflare/circl/oprf"
 
// Go implementation with excellent performance

# Install OPAQUE development tools
npm install @cloudflare/opaque-ts
pip install pyopaque
go get github.com/cloudflare/circl
 
# Testing frameworks
npm install @opaque/test-vectors

// Using a production OPAQUE library (example with @cloudflare/opaque-ts)
import { OPAQUE } from '@cloudflare/opaque-ts';
 
class ProductionOpaqueAuth {
    constructor() {
        // RFC 9807 recommended configuration
        this.opaque = new OPAQUE({
            suite: 'ristretto255-SHA512', // RFC 9807 recommended
            ksf: 'Identity'               // Key Stretching Function
        });
        this.users = new Map(); // Production: secure database
    }
 
    async registerUser(username, password) {
        console.log('🔐 Starting OPAQUE Registration (RFC 9807)');
 
        try {
            // Step 1: Client creates registration request
            console.log('Step 1: Creating registration request...');
            const regRequest = await this.opaque.createRegistrationRequest(password);
            // Client sends: blinded_element
 
            // Step 2: Server processes registration request
            console.log('Step 2: Server processing registration...');
            const regResponse = await this.opaque.createRegistrationResponse(
                regRequest,
                { serverIdentity: 'auth.example.com', clientIdentity: username }
            );
            // Server sends: evaluated_element, server_public_key
 
            // Step 3: Client finalizes registration
            console.log('Step 3: Finalizing registration...');
            const regRecord = await this.opaque.finalizeRegistrationRequest(
                regResponse,
                password,
                { serverIdentity: 'auth.example.com', clientIdentity: username }
            );
 
            // Step 4: Store credential record (contains no password information)
            this.users.set(username, {
                credentialFile: regRecord.credentialFile, // OPRF record + encrypted envelope
                serverKeyPair: regRecord.serverKeyPair    // Server's keys for this user
            });
 
            console.log('✅ Registration complete - no password stored on server');
            return {
                success: true,
                exportKey: regRecord.exportKey, // For application-specific keys
                message: 'Zero-knowledge registration successful'
            };
 
        } catch (error) {
            console.error('❌ Registration failed:', error);
            return { success: false, error: 'Registration failed' };
        }
    }
 
    async authenticateUser(username, password) {
        console.log('🔓 Starting OPAQUE Authentication (3-message protocol)');
 
        try {
            const userRecord = this.users.get(username);
            if (!userRecord) {
                // RFC 9807 Section 9.5: Prevent user enumeration
                // Return computationally indistinguishable response
                await this.constantTimeDelay();
                return { success: false, error: 'Authentication failed' };
            }
 
            // KE1: Client credential request
            console.log('KE1: Client creating credential request...');
            const credRequest = await this.opaque.createCredentialRequest(password);
 
            // KE2: Server credential response
            console.log('KE2: Server processing credential request...');
            const credResponse = await this.opaque.createCredentialResponse(
                credRequest,
                userRecord.credentialFile,
                {
                    serverIdentity: 'auth.example.com',
                    clientIdentity: username,
                    serverPrivateKey: userRecord.serverKeyPair.privateKey
                }
            );
 
            // KE3: Client recovers credentials and completes key exchange
            console.log('KE3: Client recovering credentials and completing auth...');
            const authResult = await this.opaque.recoverCredentials(
                credResponse,
                password,
                {
                    serverIdentity: 'auth.example.com',
                    clientIdentity: username
                }
            );
 
            console.log('✅ Mutual authentication successful');
 
            return {
                success: true,
                sessionKey: authResult.sessionKey,      // Shared secret with forward secrecy
                exportKey: authResult.exportKey,        // Application-specific key derivation
                serverAuthenticated: true,              // Server identity verified
                clientAuthenticated: true,              // Client password verified
                message: 'Zero-knowledge authentication successful'
            };
 
        } catch (error) {
            console.error('❌ Authentication failed:', error);
            return { success: false, error: 'Authentication failed' };
        }
    }
 
    async constantTimeDelay() {
        // Prevent timing attacks that could reveal user existence
        await new Promise(resolve => setTimeout(resolve, Math.random() * 100));
    }
 
    // Demonstrate export key usage
    async deriveApplicationKeys(exportKey, context = 'app-encryption') {
        // RFC 9807: Export key can derive application-specific keys
        const appKey = await crypto.subtle.importKey(
            'raw',
            exportKey,
            { name: 'HKDF' },
            false,
            ['deriveKey']
        );
 
        // Derive different keys for different purposes
        const encryptionKey = await crypto.subtle.deriveKey(
            {
                name: 'HKDF',
                salt: new Uint8Array(32), // In production: proper random salt
                info: new TextEncoder().encode(context),
                hash: 'SHA-256'
            },
            appKey,
            { name: 'AES-GCM', length: 256 },
            false,
            ['encrypt', 'decrypt']
        );
 
        return { encryptionKey };
    }
}
 
// Production Usage Example
async function demonstrateOpaqueAuth() {
    const auth = new ProductionOpaqueAuth();
 
    console.log('\n=== OPAQUE Registration Demo ===');
    const regResult = await auth.registerUser('alice@example.com', 'secure_password_123');
 
    if (regResult.success) {
        console.log('\n=== OPAQUE Authentication Demo ===');
        const authResult = await auth.authenticateUser('alice@example.com', 'secure_password_123');
 
        if (authResult.success) {
            console.log('\n=== Export Key Usage Demo ===');
            const appKeys = await auth.deriveApplicationKeys(
                authResult.exportKey,
                'data-encryption'
            );
            console.log('✅ Derived application-specific encryption key');
        }
    }
}
 
// Run the demonstration
demonstrateOpaqueAuth().catch(console.error);

const OPAQUE_SECURITY_GUARANTEES = {
    'Password Privacy': 'Server never sees password in any form',
    'Offline Attack Resistance': 'OPRF requires server interaction for any password guess',
    'User Enumeration Resistance': 'Server responses are computationally indistinguishable',
    'Mutual Authentication': 'Both client and server cryptographically prove their identity',
    'Forward Secrecy': 'Past sessions remain secure even if long-term keys are compromised',
    'Export Key Security': 'Additional application keys derived without exposing base secrets'
};

// RFC 9807 Section 7: Configurations
const RFC9807_CONFIGURATIONS = {
    // Recommended configuration for most applications
    'OPAQUE-3DH': {
        group: 'ristretto255',        // Primary elliptic curve group
        hash: 'SHA512',               // Hash function
        kdf: 'HKDF-SHA512',          // Key derivation function
        mac: 'HMAC-SHA512',          // Message authentication code
        ksf: 'Identity',             // Key stretching function
        security_level: 128          // Bits of security
    },
 
    // Alternative configuration using NIST curves
    'OPAQUE-3DH-P256': {
        group: 'P-256',              // NIST P-256 curve
        hash: 'SHA256',              // Hash function
        kdf: 'HKDF-SHA256',          // Key derivation function
        mac: 'HMAC-SHA256',          // Message authentication code
        ksf: 'Identity',             // Key stretching function
        security_level: 128          // Bits of security
    }
};

class SecurityBestPractices {
    async implementSecurely() {
        // Always use constant-time operations
        const isValid = await this.constantTimeVerify(proof);
 
        // Implement rate limiting
        if (this.getTooManyAttempts(username)) {
            throw new Error('Rate limited');
        }
 
        // Use secure random number generation
        const nonce = crypto.getRandomValues(new Uint8Array(32));
 
        // Validate all inputs
        this.validateUsername(username);
        this.validatePasswordStrength(password);
    }
}

class ErrorHandling {
    async handleAuthenticationErrors() {
        try {
            return await this.authenticate(credentials);
        } catch (error) {
            // Don't reveal information through error messages
            if (error instanceof OpaqueError) {
                console.error('OPAQUE error:', error);
                return { error: 'Authentication failed' };
            }
 
            // Log detailed errors internally
            this.logger.error('Auth system error:', error);
            return { error: 'System temporarily unavailable' };
        }
    }
}

class PerformanceOptimization {
    constructor() {
        // Cache cryptographic operations
        this.keyCache = new Map();
 
        // Precompute expensive operations
        this.precomputeTable = this.generatePrecomputeTable();
    }
 
    async optimizedAuth(credentials) {
        // Use Web Workers for heavy computation
        const worker = new Worker('opaque-worker.js');
        return new Promise((resolve) => {
            worker.postMessage(credentials);
            worker.onmessage = (e) => resolve(e.data);
        });
    }
}

// RFC 9807 Section 9: Security Considerations
class RFC9807SecurityRequirements {
    async implementSecurely() {
        // 1. Constant-time operations (CRITICAL)
        await this.useConstantTimeOperations();
 
        // 2. Secure random number generation
        const secureRandom = crypto.getRandomValues(new Uint8Array(32));
 
        // 3. Proper key material handling
        await this.protectSensitiveKeys();
 
        // 4. Authentication failure handling
        await this.handleAuthFailuresSecurely();
 
        // 5. Client enumeration prevention
        await this.preventClientEnumeration();
    }
 
    async useConstantTimeOperations() {
        // All cryptographic operations must be constant-time
        // to prevent timing attacks that could reveal password information
        console.log('Using constant-time crypto operations');
    }
 
    async preventClientEnumeration() {
        // RFC 9807 Section 9.5: Server responses should not reveal
        // whether a client identifier exists in the database
        const fakeResponse = await this.generateFakeCredentialResponse();
        return fakeResponse; // Return fake response for non-existent users
    }
}

// RFC 9807 Section 3.3: Export Key Usage
class ExportKeyApplications {
    async useExportKey(exportKey, applicationContext) {
        // 1. Derive application-specific keys
        const appKey = await this.deriveApplicationKey(
            exportKey,
            applicationContext
        );
 
        // 2. Use for additional authentication factors
        const totpSecret = await this.deriveTotpSecret(exportKey);
 
        // 3. Encrypt application data
        const encryptionKey = await this.deriveEncryptionKey(
            exportKey,
            'user-data-encryption'
        );
 
        // 4. Generate proof-of-possession tokens
        const possessionProof = await this.generatePossessionProof(
            exportKey,
            Date.now()
        );
 
        return {
            applicationKey: appKey,
            totpSecret: totpSecret,
            dataEncryptionKey: encryptionKey,
            possessionProof: possessionProof
        };
    }
}