AuthZilla: A Quantum-Resistant 2FA System

AuthZilla is a forward-looking, prototype 2FA (Two-Factor Authentication) system designed to be secure against attacks from both classical and future quantum computers.

It addresses two fundamental security vulnerabilities:

1. The Quantum Threat: Standard 2FA relies on cryptography (like RSA) that can be broken by quantum computers. AuthZilla uses Post-Quantum Cryptography (PQC) to be secure against this.

2. The Randomness Problem: Most security secrets are generated by pseudo-random (predictable) algorithms. AuthZilla uses Quantum Random Number Generation (QRNG) to create truly unpredictable secrets.

This project combines a modern web stack (Next.js, Drizzle, Supabase) with a dedicated Python microservice for specialized, high-security cryptographic operations.

---

🚀 Core Features

• Quantum Random Number Generation (QRNG): Uses Qiskit to simulate a quantum circuit, leveraging the inherent randomness of quantum mechanics to generate truly unpredictable 2FA secrets.

• Post-Quantum Cryptography (PQC): Implements the McEliece (code-based) algorithm as a proof-of-concept for a quantum-safe key exchange mechanism.

• Decoupled Architecture: A scalable Next.js application handles all user-facing logic, while a dedicated Flask (Python) microservice handles all sensitive cryptographic operations.

• Modern Tech Stack: Built with Next.js for the frontend and app logic, Drizzle ORM for type-safe database queries, and Supabase (PostgreSQL) for reliable data storage.

---

🛠 Tech Stack

Component	Technology	Purpose
Frontend	Next.js (React)	Responsive, server-rendered user interface.
	Tailwind CSS	Utility-first styling.
App Backend	Next.js API Routes	Primary application logic (user management, etc.).
	Drizzle ORM	Type-safe, modern ORM for database queries.
Database	Supabase (PostgreSQL)	Managed database for storing user data & secrets.
Crypto Service	Flask (Python)	Dedicated microservice for all crypto operations.
	Qiskit	Simulating QRNG for secret generation.
	pqcrypto	Implementing the McEliece PQC algorithm.
	pyotp	Generating and verifying standard TOTP codes.

---

🏗 System Architecture

The system is decoupled to ensure security and scalability. The Next.js app never performs cryptography itself; it requests secure operations from the isolated Python "Crypto Service."

User (Browser) → Next.js App → Next.js API Route → Flask Crypto-Service
                                      ↓
                            Next.js API Route → Drizzle ORM → Supabase (PostgreSQL)

---

⚙️ Getting Started

Follow these instructions to get both the frontend and backend services running locally.

Prerequisites

• Node.js (v18.0 or later)
• Python (v3.10 or later)
• A free Supabase account (for the PostgreSQL database)

1. Backend: Flask Crypto-Service

This service handles all the quantum operations.

# 1. Clone the repository
git clone https://github.com/your-username/authzilla.git
cd authzilla/backend # Or your path to the Python code

# 2. Create a virtual environment and activate it
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# 3. Install Python dependencies
pip install -r requirements.txt
# (Ensure your requirements.txt includes: Flask, flask-cors, qrcode, pyotp, pqcrypto, qiskit, qiskit-aer)

# 4. Run the Flask server
flask run --port 5000

Your crypto service is now running on http://localhost:5000.

2. Frontend: Next.js Application

This is the main application the user interacts with.

# 1. In a new terminal, navigate to the frontend directory
cd authzilla/frontend # Or your path to the Next.js code

# 2. Install Node.js dependencies
npm install

# 3. Set up your environment variables
# Create a new file named .env.local
touch .env.local

Your .env.local file should look like this:

# Get these from your Supabase project settings (API)
NEXT_PUBLIC_SUPABASE_URL="https://your-project-id.supabase.co"
NEXT_PUBLIC_SUPABASE_ANON_KEY="your-supabase-anon-key"

# URL for your local Python service
NEXT_PUBLIC_CRYPTO_API_URL="http://localhost:5000"

# 4. Set up your Supabase database
# - Log in to Supabase.
# - Go to the "SQL Editor"
# - Run your Drizzle ORM migration scripts to create the 'users' table (or create it manually).

# 5. Run the Next.js development server
npm run dev

Your Next.js app is now running on http://localhost:3000.

---

🔬 API Endpoints (Flask Service)

The Python service exposes two main endpoints:

POST /generate_qr

Action: Generates a new QRNG secret, PQC keys, and a QR code image.

Response:

{
  "qr": "data:image/png;base64,...",
  "shared_secret": "..."
}

POST /verify-otp

Action: Verifies a 6-digit TOTP code against a stored secret.

Body:

{
  "otp": "123456",
  "secret": "..."
}

Response:

{
  "valid": true
}

[Add contribution guidelines here]