Cryptography Implementation Discussion

[Ipquarx]

So based on recommendation by Lugnut, we're going to be using 128-bit ECC (256-bit numbers).
Based on this, and another 20% speed improvement on multiplication I got by replacing a couple getsubstrs, here are the speeds for the functions:

Modular Multiplication: 9ms
Modular Addition/subtraction: 0.1-0.2ms

We still need a method of generating good random numbers.

[Ad Bot]

[Lugnut]

It was your recommendation I said would probably be okay

We should implement all of them and have a variable choice - this is a support add-on, after all.

[Ipquarx]

After I have all the ECC functions that are required implemented, I'll make a general Curve scriptobject with support functions for as many kinds of things I can cram in there. Things like different key exchange protocols, etc.

It's gonna be great ;)

I'm also working on prettifying, splitting up, cleaning up, and commenting the code now.

[Ipquarx]

I just realized something.

How are we going to generate good random numbers on a dedicated server, since there is no client input?

[0xBRIANSMITH]

I just realized something.

How are we going to generate good random numbers on a dedicated server, since there is no client input?

you can do some magik with player positions.

[Lugnut]

yeah player positions and brick planting, chat message letter counts and linguistics and stuff

[Ipquarx]

As me and brian discussed, that potentially leaves the RNG open to an injection attack, especially if say, there's only one person on the server.

Me and brian thought of using the CRC of various files in the config and addons folder.

[Xalos]

Me and brian thought of using the CRC of various files in the config and addons folder.

That leaves the seed the same every time the server starts unless the host constantly changes files - or ultimately, you're still not using a crypto secure RNG.

[Ipquarx]

That leaves the seed the same every time the server starts unless the host constantly changes files - or ultimately, you're still not using a crypto secure RNG.

Well then what do you suggest? Do we have some sort of variable somewhere that has some user input and a script that generates random seeds out of that?

[Lugnut]

It wouldn't make a lot of sense for the host to comprise his own server: simply have him manually activate the key generation process after he thinks there's sufficient randomness.

[Greek2me]

It wouldn't make a lot of sense for the host to comprise his own server: simply have him manually activate the key generation process after he thinks there's sufficient randomness.

You can't trust the users like that.

That leaves the seed the same every time the server starts unless the host constantly changes files - or ultimately, you're still not using a crypto secure RNG.

Is there a to use the console.log file?

[Lugnut]

we can't trust the guy running the software!??? wtf??

why would he bug his own server?!?!?!

[Greek2me]

we can't trust the guy running the software!??? wtf??

why would he bug his own server?!?!?!

No, I mean this part:

simply have him manually activate the key generation process after he thinks there's sufficient randomness.

You can't trust them to do that right. Anyway, that's another step for the user. They shouldn't have to do that.

[Lugnut]

okayyyy but truecrypt sorta does it

maybe explicitly have the host move his blockhead and send secret random strings of letters via non-echoing servercmd

No one excluding a government agency or isp or other mitm can intercept that data
Combined with secure data transfer from client to server using keys generated client side... hmm, that has a flaw too

look at how truecrypt does it
"type 300 random characters" so you have to type 300 before it lets you enter the next phase
You can type 600 if you have enough patience

You still manually enter the next phase

Basically, have the player dance and use trigonometry or something to figure out his players rotation/position edit: the host, not a random player
Also allow input via servercmd
Allow input from all players on the server - at worst their input is predetermined and useless, at best their input increases the entropy greatly

[Zeblote]

spawn a physics vehicle shoot it into the ground and get it's rotation 500 ms later