The cryptographic core of ArkenForge. ECDSA signature verification, did:key identity, nonce generation.
arken-core is the Rust library that everything in ArkenForge builds on. It handles:
- Challenge generation — cryptographically random nonces with 60s TTL
- Signature verification — ECDSA secp256k1 viaethers-rs
- DID parsing —
did:keyidentity using the W3C spec (zQ3s…prefix for secp256k1)
It compiles to a native shared library (.dylib / .so / .dll) loaded by higher-level packages via FFI.
Requires Rust.
cd rust
cargo build --release
Output: rust/target/release/libarken_core.{dylib,so,dll}
Three C-compatible functions are exported:
int generate_challenge_into(const char *statement, char *out, int cap);
int verify_request_into(const char *header, char *out, int cap);
int verify_signature_only_into(const char *header, char *out, int cap);
All functions write JSON into out and return the number of bytes written, or -1 on buffer overflow.
An unsigned request gets a 401 with a one-time nonce. The client signs the nonce with its secp256k1 private key and retries with an Authorization: Signature header. The core verifies the ECDSA signature, checks the nonce, and returns the agent's did:key — nothing stored, nothing breached.
sequenceDiagram
participant C as Client
participant S as Server
C->>S: GET /protected
S-->>C: 401 { challenge: { nonce, statement } }
Note over C: sign(nonce, privateKey)
C->>S: GET /protected<br/>Authorization: Signature did="…",nonce="…",signature="…"
S-->>C: 200 { did: "did:key:zQ3s…" }
Each agent gets a W3C DID Key derived from its key pair:
did:key:zQ3shXgnkuyqVxf3NGBsK1q3J…
The zQ3s… prefix indicates secp256k1 (0xe7 0x01 multicodec). Same key, same DID, across every server running Arken. One identity, every tool.
| Repo | What it is |
|---|---|
| arken-core (this repo) | Rust crypto core — the foundation |
| arken-auth | Express + FastAPI middleware, client SDKs, MCP integration |
| arken-registry | Discovery registry — find APIs that accept Arken auth |
| arken-verifier | Hosted verifier — metered signature verification |
- Not production-ready. Early-stage project.
- Nonces are in memory. Won't survive restarts or work across multiple instances without a shared store.
- No key recovery. Losing the private key means losing access.
- Rust toolchain required to build. Prebuilt binaries are on the 1.0 roadmap.
See SECURITY.md. Find a flaw, open a private advisory, and your name goes in the Hall of Finders.
Founding Builders — everyone who joins before December 15, 2026 — are credited by name in the 1.0 README. There are 10 design-partner slots for teams who want to shape the API directly.
Apache 2.0 — ArkenForge