# The Arnacon Authentication Module

Jonathan
Kandel
Cellact B.V.
jonathan@cellact.com
2025
Cellact B.V.

## Admin Guide

### Overview

The Arnacon Authentication module provides ENS-based authentication for Kamailio by verifying ENS domain ownership through cryptographic signature validation. This module enables users to authenticate using their ENS domains (e.g., user.cellact.global) instead of traditional username/password combinations.

The module implements a secure authentication flow where clients sign a message containing a UUID and timestamp, and the module verifies that the signature comes from the current owner of the specified ENS domain. This provides strong cryptographic authentication while maintaining compatibility with existing SIP infrastructure.

Key features:

- ENS domain-based authentication

- ECDSA signature verification using secp256k1

- Support for both traditional and wrapped ENS domains

- Automatic ENS Name Wrapper detection and handling

- Configurable signature timeout for replay attack prevention

- Multi-network support (Polygon, Ethereum, custom networks)

### Technical Details

The module implements a comprehensive ENS-based authentication system with the following technical features:

#### ENS Resolution

The module supports both traditional ENS ownership and wrapped domain ownership:

- Direct ownership via ENS Registry contract

- Wrapped domain ownership via ENS Name Wrapper contract

- Automatic detection of wrapped vs traditional domains

- Zero address detection for unregistered domains

#### Signature Verification

Implements Ethereum-style message signing and verification:

- Ethereum message prefix handling (\x19Ethereum Signed Message:\n)

- ECDSA signature recovery using secp256k1

- Address recovery from signature for ownership verification

- Timestamp validation to prevent replay attacks

#### Multi-Network Support

- Primary support for Polygon network

- Configurable for Ethereum mainnet, testnets, or custom networks

- Custom RPC endpoint configuration

- Flexible contract address configuration for different networks

#### Security Features

Comprehensive security measures to ensure authentication integrity:

- Replay attack protection via timestamp validation

- Cryptographic signature verification

- ENS ownership verification against blockchain state

- Configurable signature timeout (default 30 seconds)

### Dependencies

The following modules must be loaded before this module:

- none

External dependencies:

- libcurl - HTTP client library for blockchain RPC calls

- libsecp256k1 - cryptographic library for ECDSA signature operations