brig·idSelf-hosted identity, done properly: passkeys, OIDC and post-quantum cryptography.
STATUS EARLY STAGE
DRAWN: B.
SCALE 1:1
DRAWN: B.
SCALE 1:1
1.0 Overview
An identity provider that a team or an individual can run themselves, built around passkeys (WebAuthn), OIDC and hybrid post-quantum cryptography, and compatible with decentralized identifiers (DID:web).
It is early: the specifications and the security model are public, the first core release is out, and the server tiers are taking shape. A personal tier (single binary, SQLite, distroless image) comes first; a team tier (PostgreSQL and Redis) follows.
RustQwikWebAuthnOIDCPost-quantum
2.0 Specification
| Status | Early stage |
|---|---|
| Organization | brig-id |
| License | LGPL-3.0 |
| Languages | Rust |
| Started | May 24, 2026 |
| Last activity | Nov 2, 2026 |
| Latest release | core v0.1.0 · Sep 4, 2026 |
| Component | Description | License | Latest release |
|---|---|---|---|
| Core | Shared Rust workspace: identity, DID, OIDC, WebAuthn, encrypted store, API.Rust workspace · First release v0.1.0 | LGPL-3.0 | v0.1.0 · Sep 4, 2026 |
| Crypto | Post-quantum and classical primitives: AES-256-GCM, HKDF-SHA3, ML-KEM-768, ML-DSA-65, Ed25519.Hybrid post-quantum design | LGPL-3.0 | — |
| Spec | Public specifications, security model and protocol documentation, written for audit readiness.Documents first | LGPL-3.0 | — |
| Server (leaf) | Personal server tier: a single binary, SQLite, distroless Docker image.Team tier (Grove) comes after 0.0.1 | LGPL-3.0 | — |
3.0 Releases
4.0 Quality gates
- No unsafe, no dependenciesThe Rust crate forbids unsafe code; both libraries ship zero dependencies.
- AI-ready documentationllms.txt and AGENTS.md in both libraries; every Rust example is a doc test.
5.0 Collaborate
I am looking for help with:
- Review of the specifications and the security model.
- Cryptography and security engineers willing to read the code.
- Feedback from people who would self-host an identity provider.
Open work 8 issues waiting for a hand
- WO-01Help wantedAudit JWT signing: confirm Ed25519/EdDSA-only, add algorithm-confusion regression testscore #21 ↗
- WO-02Help wantedPersist authenticator device name for passkeyscore #46 ↗
- WO-03Good first issueHelp wantedRaise test line coverage to ≥ 98%crypto #1 ↗
- WO-04Help wantedAdd FIPS 203/204 known answer tests for hybrid KEM/DSA wrapperscrypto #3 ↗
- WO-05Help wantedDocument identity data model additions: templates, username rules, recovery passphrasespec #8 ↗
- WO-06Good first issueHelp wantedValidate docker compose dev workflow on a non-nested-Docker hostserver-leaf #11 ↗
- WO-07Help wantedAdd in-process health-check for leaf (Docker/Swarm liveness probe)server-leaf #33 ↗
- WO-08Help wantedAdd production metrics/observability endpoint to leafserver-leaf #34 ↗
Looking for collaborators, feedback or a conversation about any of this? These are the ways to reach me.
DrawingBAXYZ-130
Repos4
Sheet6 / 12