Introduction
zkLogin is a groundbreaking solution addressing blockchain's persistent onboarding friction caused by wallet complexity. Leveraging advanced cryptography, zkLogin simplifies OAuth-based authentication on Sui. This guide explores its mechanics, security protocols, and how Sui’s architecture enables this seamless login process.
How zkLogin Works
zkLogin generates a unique Sui address for each OAuth credential + app combination. A single OAuth account (e.g., Google) can manage distinct addresses across multiple apps.
Key Innovation:
- Unlike traditional addresses tied to static key pairs, zkLogin uses ephemeral keys derived from OAuth provider payloads (the "key claim").
- Addresses remain fixed while underlying keys refresh via OAuth logins.
The 6-Step zkLogin Process
Generate Ephemeral Keys
- Apps create temporary key pairs with expiration periods, dictating login frequency.
Obtain a JSON Web Token (JWT)
Users authenticate via OAuth (e.g., Google), receiving a JWT containing:
- A nonce (public key + expiry).
- The key claim (used for address generation).
Request User Salt
- A unique salt (numeric string) binds OAuth credentials to the Sui address.
Salt Management Options:
- SSO-style service: Centralized salt storage/retrieval.
- User-managed: Treated like a password (self-stored).
Generate Zero-Knowledge (zk) Proof
A zk proving service validates:
- Correct nonce structure.
- Consistency between key claim/JWT.
- Address alignment with salt/key claim.
- Valid OAuth provider signature.
Construct Transaction
- The app derives the Sui address from the salt/key claim.
- Transactions are signed with the ephemeral private key, zk proof, and JWT data.
Transaction Validation
- Sui validators verify the zk proof and ephemeral signature before logging the transaction.
Security Considerations
For Users:
- OAuth Account Security: Losing access to OAuth credentials means losing Sui address access.
- Enable 2FA: Critical for protecting both OAuth accounts and linked Sui addresses.
For Builders:
- Salt Protection: Treat salts as sensitive data (like passwords).
- Prover Hosting: Run zk proving services in-app to prevent third-party salt exposure.
👉 Best practices for zkLogin integration
Why Sui Excels with zkLogin
Cryptographic Agility
- Supports multiple authentication schemes natively (no extra gas costs).
- New methods integrate seamlessly without disrupting existing systems.
JWKs as Sui Objects
- Eliminates reliance on oracle-posted data. Validators directly verify JWKs, enhancing security.
Future of zkLogin
- Expansion to more OAuth providers.
- Enhanced features for broader use cases.
- Ecosystem growth as developers adopt zkLogin.
👉 Explore zkLogin documentation
FAQ
Q: Can I use multiple OAuth accounts with one Sui address?
A: No—each OAuth/app pair generates a unique address.
Q: What happens if my OAuth account is compromised?
A: Without the user salt, attackers cannot access linked Sui addresses.
Q: Is zkLogin compatible with all Sui dApps?
A: Yes, if builders implement the protocol.
Q: How often do ephemeral keys expire?
A: Set by the app (e.g., 24 hours).
Q: Can I recover a lost salt?
A: Depends on salt management method (SSO service vs. user-stored).
### Key Features:
- **SEO Optimized**: Keywords like "zkLogin," "Sui authentication," and "OAuth blockchain" integrated naturally.