The point of Ruby in the context of a T2 revival is that it has built in support for math on very large numbers (think 303 digits long), whereas the largest number you can work with TorqueScript without reducing numerical accuracy is 2147483647. Even that large of a number is dubious, due to bugs in the script interpreter that corrupt least significant bits of a number.
Why do we care about the ability to work with huge numbers? Seems rather useless until you think about the numerical requirements for asymmetric cryptography. Every major asymmetric cipher relies on some operations being very slow on large numbers, while other operations are very fast. Asymmetric cryptography enables writing a script that lets one person prove that a message came from another person, and that one person is who they say they are. By now, I hope you can see how this would be useful for an authentication system.
A player can send an account request message to the authentication server. The authentication server can then create a ticket for the player that says the account is valid. When the player joins a game server, the server can check the ticket to see if the account is valid, and can make sure the player is who they say they are. Any changes to the ticket will make it invalid.
The only way to do this is to allow asymmetric roles, where there are separate signature and verification roles. Where anyone can verify a signature, but nobody can forge a signature.
RSA is one of the (conceptually) simplest asymmetric ciphers. There are three numbers: E, D, and N. E and N are public, and can be known to anyone (they are used for verification). D is private, known to only one person (used for signatures). The authentication server has an E/D/N set, and each player has their own E/D/N set. N is calculated as a multiple of two prime numbers (P and Q). P and Q are used to calculate E and D through the Euclidean extended algorithm. The only real way (provided special precautions are taken when choosing P and Q) to get D from E and N is to factor N into P and Q.
Easy, right?
15 = 3 * 5, any child could figure that out.
2224927 = 71 * 31337, a bit more complicated, but a computer could do that in a fraction of a second
What if we go higher? This next one is 512 bits, or 156 digits.
1038557801480495022106519019573649119384754147938
9728420426514083771326945639729736695791225573893
7931194893360122978451461046376919412424857328392
77543427 = 903363060349886081779903699376749423125
98126945629080039358980696516831956279 * 114965715
0114424632841121950270840554465040708908568676185
84335022146211064213
That took a distributed effort several months to crack. It was the RSA-512 server key used in the Earth and Beyond MMORPG. The server emulator community put together their computing resources to crack that back in 2006. On a modern high-end 8 core Xeon, the same computation might be possible in under 6 months.
Yet, at the same time, you can verify that factorization in a tiny fraction of a second. Multiplication is fast. Factoring isn't.
The idea is to use an RSA-1024 bit key for the authentication server, and if possible, for all clients. It would take about a century to compute the modulus factors, so it is safe from cracking. Finally, in the event my authentication system goes down, anyone with an existing ticket would still be able to play.
That's why I asked Turkey to integrate Ruby with T2.
The least complicated way to solve that is to run the classic batch file in your gamedata directory. Else, just add -login name to the online shortcut.
still wont work. keeps sayin i need to start it usin supplied shortcut. this is the DLed version from the rawr32 database, with ACCM mod. I dropped ruby in there too, tried changing the shortcut destination to it, and yet the bastard seems to STILL want to go through the broken patcher. maybe if i DL something like meltdown to start up with?
still wont work. keeps sayin i need to start it usin supplied shortcut. this is the DLed version from the rawr32 database, with ACCM mod. I dropped ruby in there too, tried changing the shortcut destination to it, and yet the bastard seems to STILL want to go through the broken patcher. maybe if i DL something like meltdown to start up with?
Update on T2DeVo: They've decided to merge with http://www.tribaloutpost.com/ because the webmaster has a lot on his own plate in life, so, he handed it over to someone who could manage it better than he could.
Update on the RSA Ruby script: I got it working, mostly. There are still a couple of tiny details that have to be worked out... but here is one of the first 1024 bit RSA keys generated via the ruby script:
You can use an arbitrary precision calculator to see that those E/D/N values work.
Encryption/decryption take insignificant fractions of seconds. However, key generation does take anywhere between 6 and 70 seconds for an RSA1024 key. Over 99.9% of this time is spent searching for two prime numbers (P and Q), and the nature of the prime search is what causes that huge time variability. Since this will only need to be done once during account creation, it should be bearable. The script is about 250 lines of code now.
For the really impatient people, I'll probably add settings for RSA-512 and RSA-768 keys. For the really paranoid people, I'll have settings for RSA-1536 and RSA-2048 key generation.
RSA script is done. I ran into some unexpected issues with the lack of the cryptography standard library in Turkey's T2 Ruby integration, so I had to implement SHA1 in Ruby.
SHA1 in pure Ruby is about 5-6 times slower than the built in OpenSSL implementation (compiled and highly optimized C), but key generation times still are under 2 minutes for RSA1024. Acceptable speed. With the SHA1 class, the script has grown to 458 lines of code.
I'm ready to start working on the login GUI, the account creation wizard, authentication server system, and the identity verification scripts for the T2 game server/client.
The Ruby part of the script is done. Everything works perfectly in the Ruby console. SHA1 hashing, RSA encryption, RSA decryption, and RSA key generation. However, there appears to be some stability problems with Turkey's integration of Ruby into T2. I am able to generate an RSA key of 256 bits perfectly, but 512 bit keys and above result in an abrupt crash of the game (without a UE).
More investigation is required, but for now... feel free to play with the script, and do RSA-256 encryption in T2.
Comments
Whoa
Idiot translation please.
Encryption/decryption take insignificant fractions of seconds. However, key generation does take anywhere between 6 and 70 seconds for an RSA1024 key. Over 99.9% of this time is spent searching for two prime numbers (P and Q), and the nature of the prime search is what causes that huge time variability. Since this will only need to be done once during account creation, it should be bearable. The script is about 250 lines of code now.
For the really impatient people, I'll probably add settings for RSA-512 and RSA-768 keys. For the really paranoid people, I'll have settings for RSA-1536 and RSA-2048 key generation.
SHA1 in pure Ruby is about 5-6 times slower than the built in OpenSSL implementation (compiled and highly optimized C), but key generation times still are under 2 minutes for RSA1024. Acceptable speed. With the SHA1 class, the script has grown to 458 lines of code.
I'm ready to start working on the login GUI, the account creation wizard, authentication server system, and the identity verification scripts for the T2 game server/client.
I think the hard stuff is all finished now.
Edit: I figure I might as well make the script available to the public: http://absolous.no-ip.com/files/crypto.rb
The Ruby part of the script is done. Everything works perfectly in the Ruby console. SHA1 hashing, RSA encryption, RSA decryption, and RSA key generation. However, there appears to be some stability problems with Turkey's integration of Ruby into T2. I am able to generate an RSA key of 256 bits perfectly, but 512 bit keys and above result in an abrupt crash of the game (without a UE).
More investigation is required, but for now... feel free to play with the script, and do RSA-256 encryption in T2.
Btw you should try Wotlk
e t r
d a m
r y
RSA -> Rivest, Shamir, Adleman -- initials of the creators
Rivest -> Ronald Rivest
Shamir -> Adi Shamir
Adleman -> Leonard Adleman
RSA was first described by that group in 1977 and patented by MIT in 1983 as part of a communications system.
It's been around longer than just about everyone on this forum has been alive.
add " -online"
to the end of the shortcut's target location under "properties".