Encrypted local data in competitive online ranked shmups..

A place for people with an interest in developing new shmups.
Post Reply
User avatar
n0rtygames
Posts: 1001
Joined: Thu Mar 15, 2012 11:46 pm
Contact:

Encrypted local data in competitive online ranked shmups..

Post by n0rtygames »

Warning! Approach this topic with logic and caffeine, are you ready?

So, as some may be aware the project I'm currently working on has a fully integrated level editor and have recently implemented the ability to script behaviour of individual bullets in a very simple and human readable format. while I still need to do some stuff tying up the loose ends and making this all fairly accessible to the noddy end user - this is leaving me with something to really think about.

For simplicity, it would be great to just have plain text files. Oh that would be so sweet. But once I start throwing online scores in to the mix - some issues begin to arise. So I'm wondering what you fellow devs might think of the following solutions:-

I want to use the editor and script functionality to create levels, patterns and alternative rulesets with ease. I spent a while on stream last night explaining to Cagar why Chronoblast took so damned long to create and why workflow was a serious bottleneck in the overall quality of the game. I think he got it in the end :)

I see a few options, but I'm wondering if there are other solutions:-

Option 1:-
* Use editors and scripts to create prototype rulesets for the game.
* Once complete, run them through a shell script to generate code and actually hard code this in to the game

Option 2:-
* Leave the files sitting around for people to modify
* Disallow ranked play if a checksum of the files does not match up

Option 3:-
* Tag high score entries with a combined checksum for all the rulesets, levels and scripts
* Allow these to be uploaded and make client request that specific checksum when fetching high score tables

Option 4:-
* Come up with some sort of ultimately pointless local encryption (urgh)

Note, because of my lack of stable testers this does mean that I'll probably only be looking at doing local scores this time around for 360 - due to XBLIG being a pile of steaming poo - but for other sane platforms that allow me to actually "speak internets" I'll definitely be doing this stuff.

</braindump>
facebook: Facebook
User avatar
nasty_wolverine
Posts: 1371
Joined: Sun Oct 09, 2011 11:44 pm

Re: Encrypted local data in competitive online ranked shmups

Post by nasty_wolverine »

Option 2

Less of hassle to implement. Cheaters gonna cheat, exactly how crackers will crack no matter the encryption or DRM used. Make it atleast a little easy on yourself, and just goddammit release chronoblast for PC already!!!! And put a decent pricetag this time around.
Elysian Door - Naraka (my WIP PC STG) in development hell for the moment
User avatar
n0rtygames
Posts: 1001
Joined: Thu Mar 15, 2012 11:46 pm
Contact:

Re: Encrypted local data in competitive online ranked shmups

Post by n0rtygames »

nasty_wolverine wrote:and just goddammit release chronoblast for PC already!!!! And put a decent pricetag this time around.
https://twitter.com/shmups/status/385828520611426305

https://twitter.com/shmups/status/385827552620589056

!!!!!!
facebook: Facebook
User avatar
BPzeBanshee
Posts: 4859
Joined: Sun Feb 08, 2009 3:59 am

Re: Encrypted local data in competitive online ranked shmups

Post by BPzeBanshee »

Only problem with #2 that I can think of (otherwise I'd use it too) is that if you have a local highscore file and work from there, of course the checksum for it is going to change all the time, and as for the rest of the files that won't defend against spoofing packets by itself: but appropriate encryption of said data with handshake process of some sort should do the trick there anyway, and it still looks like less work than the others.
HydrogLox
Posts: 1164
Joined: Tue May 22, 2012 3:35 pm
Location: Ontario, Canada

Re: Encrypted local data in competitive online ranked shmups

Post by HydrogLox »

A hybrid between option 2 and 4 might be the sweet spot. I would look into the possibility of creating a local component for submitting online high-scores that only accepts submissions from a local digitally signed component (secure transmission to the remote leader board is another concern - one you may have little control over).
  • You create your configuration/script text files.
  • You generate the "original" script/configuration components from those text files signing them with your own certificate.
  • The game itself allows use of unsigned script/configuration components - the online score submission component does not.
  • You supply the original configuration/script text files to the end user and also include the facility to generate unsigned script/configuration components. Now they can mod on a local level to their heart's content.
Is all this worth it just to ensure that the online high scores are actually comparable? Personally I'm more interested in beating my own high score - there will always be other people that are better than me. If the online leader boards only show the top N players then all this effort only benefits those top N players - not every customer of your product.
User avatar
trap15
Posts: 7835
Joined: Mon Aug 31, 2009 4:13 am
Location: 東京都杉並区
Contact:

Re: Encrypted local data in competitive online ranked shmups

Post by trap15 »

Just do option #1 >_>
@trap0xf | daifukkat.su/blog | scores | FIRE LANCER
<S.Yagawa> I like the challenge of "doing the impossible" with older hardware, and pushing it as far as it can go.
User avatar
BrooksBishop
Posts: 63
Joined: Sun Aug 05, 2012 4:39 am
Location: San Diego, CA
Contact:

Re: Encrypted local data in competitive online ranked shmups

Post by BrooksBishop »

I think you've got two basic points of attack to worry about, which require their own solutions.
-Modifications to underlying data (bullet scripts, code, etc.)
-Interception/replay attack on submitted score

What you've got outlined are mostly relevant to the former.
Option 1 would probably be the quickest and easiest to implement.

But that still leaves the submission problem.
I think another big question to ask, is how are you going to handle the server side components?
Will you require signups and logins? Or will names and scores be submitted bare?

Downside of accounts:
-You have to build the setup for it, and properly handle security.
-Kind of a pain for end users to have to have another login.
Upside of accounts:
-Use of public-key cryptography prevents man-in-the-middle attacks
-Scores are then tied to a specific account name, which means if you discover impropriety you can flag the account as bad and disavow the scores for official ranking

warning: crazy sleep-deprived stream of thought idea incoming
Off the top of my head, if you really want a secure high score table:
Implement Replay files.
From there require submission of a replay you can watch and verify on your own in order to manually curate a high score table. It's a lot harder to fake a whole run than it is to fake an end result number.
Aeternum a bullet hell on PC and Xbox Live Indie Games - @BrooksBishop - Aeternum OST
User avatar
n0rtygames
Posts: 1001
Joined: Thu Mar 15, 2012 11:46 pm
Contact:

Re: Encrypted local data in competitive online ranked shmups

Post by n0rtygames »

BrooksBishop wrote: Off the top of my head, if you really want a secure high score table:
Implement Replay files.
Already a feature, just need to fix up some sync issues. ;)

Good ideas here Brooks - gonna talk to you some more about all this over in the other place...
facebook: Facebook
User avatar
nasty_wolverine
Posts: 1371
Joined: Sun Oct 09, 2011 11:44 pm

Re: Encrypted local data in competitive online ranked shmups

Post by nasty_wolverine »

n0rtygames wrote:
nasty_wolverine wrote:and just goddammit release chronoblast for PC already!!!! And put a decent pricetag this time around.
https://twitter.com/shmups/status/385828520611426305

https://twitter.com/shmups/status/385827552620589056

!!!!!!
:oops:

Also, agree with trap. I dont mind hardcoding either. Like the archlinux philosophy, everything is tuned to the ease of the developer.
Elysian Door - Naraka (my WIP PC STG) in development hell for the moment
Post Reply