IC Auth

Independent application authentication protocol libraries for the Internet Computer, with a wallet-authentication service planned.

The accepted scope includes IC signatures, application tokens, local application sessions and wallet-backed IC identities. Canic will consume the libraries; applications such as Toko will integrate through a documented client/service contract. The libraries and reference service must not depend on either project.

Status

The Rust workspace implements passive token/proof contracts, validated protocol identifiers, canonical signed encoding and optional IC canister-signature verification extracted from Canic. Both libraries are published on crates.io at 0.1.3; see the signature contract. The working tree adds complete application-token verification with protected host inputs and both root/issuer proof checks; see the token contract. This new API is not yet published. Session admission and wallet login remain unimplemented. A verified token does not grant application resource ownership. The native utility in apps/tooling/ is unpublished and reuses ic-host-fs/ic-host-artifacts for release and publication file operations.

Canic still runs its existing implementation. Its adapter adoption and removal of superseded code require a separately authorized Canic change.

• Architecture and ownership
• Current handoff
• Developer setup and commands
• Canic source review and incorporation boundary
• Extraction and Canic adoption tracker
• Agent instructions

Workspace

Cargo.toml                     # Virtual workspace and dependency catalog
Cargo.lock                     # One selected Rust dependency graph
crates/
  ic-auth-protocol-types/      # Passive auth contracts and validated identifiers
  ic-auth/                     # Canonical encoding and optional signature/token verification
apps/
  tooling/                     # Unpublished native release/publication file utility

The types package is ic-auth-protocol-types (Rust import ic_auth_protocol_types). The unrelated ic_auth_types package belongs to another IC-Auth project and does not implement our application token/proof contracts. Crates.io treats hyphens and underscores as colliding names, so changing only the punctuation cannot resolve that conflict.

Future service and client packages belong in apps/wallet-auth/ and packages/client/. They are not created as empty or accepting placeholders.

With the declared tools prepared, run the focused checks:

make test-types
make test-protocol
make test-signatures
make test-tokens
make check-wasm

Planned wallet authentication targets Solana message signing without SIWS or ic-siws. NFTs remain in their application's ledger. This service does not mint, index, bridge or custody Solana assets.

Canic integration uses local library calls. It must not add a remote authentication request to every protected application call.