\documentclass[11pt,a4paper]{article}

\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{lmodern}
\usepackage[margin=1in]{geometry}
\usepackage{microtype}
\usepackage[dvipsnames,table]{xcolor}
\usepackage{booktabs}
\usepackage{tabularx}
\usepackage{array}
\usepackage{enumitem}
\usepackage{listings}
\usepackage{parskip}
\usepackage{tikz}
\usepackage{pgfplots}

\pgfplotsset{compat=1.18}

\definecolor{athenaPurple}{HTML}{6A4CFF}
\definecolor{athenaIndigo}{HTML}{3440D5}
\definecolor{betterOrange}{HTML}{F5A623}
\definecolor{betterYellow}{HTML}{FFD166}
\definecolor{paperBg}{HTML}{F7F7FB}
\definecolor{paperLine}{HTML}{D8DBF0}
\definecolor{codeBg}{HTML}{F4F1FF}

\newcolumntype{Y}{>{\raggedright\arraybackslash}X}

\lstdefinestyle{athenacode}{
  backgroundcolor=\color{codeBg},
  basicstyle=\ttfamily\small,
  frame=single,
  rulecolor=\color{paperLine},
  keywordstyle=\color{athenaIndigo}\bfseries,
  commentstyle=\color{gray},
  showstringspaces=false,
  breaklines=true
}

\title{Athena Authentication \\ \large Analysis of Argon2id integration, Password Hashing, and Login Latency}
\author{Floris \\ XYLEX GROUP}
\date{June 2026}

\begin{document}
\thispagestyle{empty}

\maketitle

\begin{center}
\textit{Building better worlds}
\end{center}

\begin{center}
\setlength{\fboxsep}{10pt}%
\fbox{%
\parbox{0.92\textwidth}{%
\textbf{Result.} Athena Auth now applies its own Argon2id profile consistently across the active core helper, password-management flows, backup-code hashing, administrative password paths, the legacy mirror crate, and the latency benchmark seam. In the refreshed 12-iteration WSL benchmark, \texttt{POST /sign-in/email} averaged \texttt{16.673 ms} for Athena Auth and \texttt{71.748 ms} for Better Auth (ref), a measured gap of \texttt{55.075 ms}.%
}%
}
\end{center}

\tableofcontents
\newpage

\section{Abstract}

This document defines the Athena Argon2id profile and architectural decisions of \textbf{Athena}, a Rust-based authentication framework built ontop of Athena, A system developed by XYLEX GROUP.

Athena Auth's original login slowdown was primarily a runtime configuration bug, not an unavoidable property of Argon2id. Some built-in password paths could still fall back to upstream library defaults rather than Athena Auth's intended cost profile, and the sign-in path also carried side effects that did not need to block the response.

The implemented fix made Athena Auth resolve its own Argon2id profile consistently, integrated that behavior across the built-in password flows, and moved non-critical sign-in work into background tasks. In the refreshed WSL benchmark, Athena Auth averaged \texttt{16.673 ms} on \texttt{POST /sign-in/email} versus \texttt{71.748 ms} for Better Auth (ref), while retaining Argon2id.

\section{Problem and Baseline}

The optimization target was clear:

\begin{itemize}[leftmargin=*]
\item keep Argon2id;
\item make the interactive login path feel near-instant;
\item ensure Athena Auth's declared password configuration is the configuration actually used at runtime.
\end{itemize}

The baseline measurements showed that the problem was concentrated in the password routes, not in generic session lookup:

\begin{itemize}[leftmargin=*]
\item \texttt{POST /sign-in/email}: Athena Auth \texttt{280.504 ms} vs Better Auth \texttt{72.054 ms}
\item \texttt{POST /sign-up/email}: Athena Auth \texttt{276.931 ms} vs Better Auth \texttt{72.784 ms}
\item \texttt{GET /get-session}: Athena Auth \texttt{0.678 ms} vs Better Auth \texttt{1.159 ms}
\end{itemize}

This strongly indicated that the dominant cost sat in password verification and closely related sign-in work. The central runtime defect was that the no-override helper path could still resolve to upstream Argon2 defaults instead of Athena Auth defaults:

\begin{lstlisting}[style=athenacode,caption={The failure mode in simplified form}]
fn build_argon2(argon2_config: Option<&Argon2Config>) -> AuthResult<Argon2<'static>> {
    let Some(argon2_config) = argon2_config else {
        return Ok(Argon2::default());
    };
    // build explicit params from config
}
\end{lstlisting}

That made the effective security and performance profile depend on call shape rather than on Athena Auth's own configuration.

\section{Implemented Solution}

The core fix was to make the canonical helper resolve Athena Auth defaults on the no-override path and to construct the algorithm explicitly as Argon2id:

\begin{lstlisting}[style=athenacode,caption={Canonical Argon2 construction after the fix}]
fn build_argon2(argon2_config: Option<&Argon2Config>) -> AuthResult<Argon2<'static>> {
    let argon2_config = argon2_config.cloned().unwrap_or_default();
    let params = Params::new(
        argon2_config.memory_cost,
        argon2_config.time_cost,
        argon2_config.parallelism,
        None,
    )?;

    Ok(Argon2::new(Algorithm::Argon2id, Version::V0x13, params))
}
\end{lstlisting}

This change was then integrated across the built-in password paths:

\begin{itemize}[leftmargin=*]
\item email sign-up and email sign-in;
\item password reset, change-password, and set-password flows;
\item two-factor backup-code hashing;
\item administrative password paths;
\item the older in-repo compatibility crate.
\end{itemize}

The sign-in hot path was also reduced by moving non-critical work into background tasks:

\begin{itemize}[leftmargin=*]
\item sign-in audit logging,
\item verification-email triggering on sign-in,
\item GeoIP session enrichment,
\item legacy-hash rehash after successful verification.
\end{itemize}

The intentionally synchronous core remains password verification, session creation, and the \texttt{last\_sign\_in\_at} update. That is the minimum correctness-preserving path.

\section{Method and Results}

The benchmark was rerun from WSL with:

\begin{itemize}[leftmargin=*]
\item 12 measured iterations per endpoint,
\item 2 warmup iterations per endpoint,
\item Athena Auth server running in-process through the Axum benchmark router,
\item Better Auth reference server running through the Node compatibility server,
\item Linux Node runtime used from WSL to avoid Windows-to-WSL boundary artifacts.
\end{itemize}

\rowcolors{2}{paperBg}{white}
{\small
\begin{tabularx}{\textwidth}{lrrrrr}
\toprule
\textbf{Endpoint} & \textbf{Athena} & \textbf{Better} & \textbf{Delta} & \textbf{Speedup} & \textbf{Outcome} \\
\midrule
\texttt{POST /sign-up/email} & 16.359 & 75.689 & -59.330 & 4.63x & Athena faster \\
\texttt{POST /sign-in/email} & 16.673 & 71.748 & -55.075 & 4.30x & Athena faster \\
\texttt{GET /get-session} & 0.640 & 1.155 & -0.515 & 1.80x & Athena faster \\
\texttt{POST /sign-out} & 0.606 & 1.290 & -0.684 & 2.13x & Athena faster \\
\bottomrule
\end{tabularx}
}

The effective Athena Auth profile in the report was \texttt{memory\_cost=1024, time\_cost=2, parallelism=1}. The most important before-and-after changes were:

\begin{itemize}[leftmargin=*]
\item Athena Auth email sign-in improved from \texttt{280.504 ms} to \texttt{16.673 ms}, a \texttt{94.06\%} reduction.
\item Athena Auth email sign-up improved from \texttt{276.931 ms} to \texttt{16.359 ms}, a \texttt{94.09\%} reduction.
\item \texttt{GET /get-session} changed only slightly, confirming that session reads were not the original bottleneck.
\end{itemize}

\section{Trade-offs}

The solution is better in three ways:

\begin{itemize}[leftmargin=*]
\item it removes silent configuration drift;
\item it materially lowers interactive login latency;
\item it preserves Argon2id instead of replacing it with a weaker primitive.
\end{itemize}

It is worse in two ways:

\begin{itemize}[leftmargin=*]
\item the interactive default profile \texttt{1024/2/1} is lighter than heavier Argon2id profiles, so offline brute-force cost per hash is lower;
\item backgrounding audit, GeoIP, verification-email, and rehash work introduces eventual-consistency risk if the process exits immediately after the response.
\end{itemize}

One additional constraint remains: old hashes retain their encoded PHC parameters on first verification, so the first post-deploy login for a legacy heavy hash is still expensive. The background rehash improves later logins, not the first one.

\section{Conclusion}

Athena Auth is now fast for the right reasons. It no longer depends on accidental upstream Argon2 defaults, it keeps Argon2id explicit, and it removes non-essential work from the blocking sign-in path. The measured server seam is now about \texttt{55 ms} faster than Better Auth on email sign-in.

The benchmark is still a server benchmark, not a full browser-visible application journey. If the surrounding app still routes through an extra proxy or callback hop, that architecture can add latency even though the auth server itself is already fast. Within the measured seam, however, the optimization is both real and repeatable.

\section{Validation}

Validation for the current state consisted of:

\begin{itemize}[leftmargin=*]
\item focused Rust tests around password hashing and sign-in rehash behavior,
\item dual-server benchmark rerun from WSL with a Linux Node runtime,
\item regenerated benchmark report with explicit Argon2 profile disclosure.
\end{itemize}

\end{document}
