Re: Current examples for creating keys, updating and getting freesites
Michael Pearce <michaelgpearce-/[email protected]> Tue, 12 Nov 2013 01:07:36 -0800 (PST)
| Newsgroups | gmane.network.freenet.technical |
|---|---|
| Message-ID | <[email protected]> |
--===============0625413170== Content-Type: multipart/alternative; boundary="-876742037-932695504-1384247256=:77492" ---876742037-932695504-1384247256=:77492 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Thanks for the response! =A0All good information. =A0Its fun to think about= how to build a system with the very specific constraints that Freenet impo= ses.=0A=0AI'm not building a messaging application per se, but users will n= eed to communicate and most identities will not be very long-lived. =A0This= is leading me towards thinking I can get away with a single key to announc= e new messages. =A0I was also thinking about adding a Nonce to the message = combined with an expensive hashing algorithm (i.e. BCrypt) so spamming a us= er takes some work on the spammer's side.=A0=0A=0AA sender would create a m= essage similar to:=0A=0ASender <- my public identifier=0A=0ARecipient <- re= cipient's public identifer=0ANonce <- unique value to this recipient from t= he sender for this message=0A=0ASenderSignature <- sender signs message wit= h (recipient, nonce) to ensure sender is who he says he is=0AAntiSpamHash <= - Bcrypt(recipient, nonce, minimum_rounds) to force some work on the sender= =0A=0AMessageBodyId <- location of signed/encrypted message body located at= a different Freenet key=0A=0AAs a receiver checking for incoming messages,= he only fetches the message body for messages that:=0A=0A* Have himself as= the recipient=0A* Have a unique Nonce from the sender (no duplicates to av= oid signature / anti-spam value stealing)=0A* Correct signature at SenderSi= gnature=0A* Correct AntiSpamHash=0A=0AIf all of these match, the receiver w= ill then retrieve the message body.=0A=0AI think the above scheme will allo= w for looking at the shared key pretty quickly, and a computationally expen= sive AntiSpamHash will disincentivize large amounts of spam. =A0Definitely = not perfect but it may be good enough for my needs.=0A=0A=0A=0AOn Sunday, N= ovember 10, 2013 2:38 PM, Steve Dougherty <steve-kVTqj8yhOEv2eFz/[email protected]> wrote:=0A = =0AOn 11/10/2013 12:45 AM, Michael Pearce wrote:=0A> Hi Steve.=0A> =0A> I'm= using Ruby and the library for Ruby is... well... a little out of=0A> date= .=A0 There were a couple of quick changes to make (syntax for Ruby=0A> 1.9 = and library changes), but i was having a hard time getting things=0A> to wo= rk with making a blocking request...=A0 Since i really want to do=0A> just = a few simple things, i'll most likely roll my own library and=0A> publish a= s a Ruby Gem.=0A=0AAlright, sounds good.=0A=0A> I did have another question= : How do applications such as a "chat"=0A> work?=A0 The only way that I cou= ld think of is to have multiple clients=0A> sharing the same SSK private ke= y, publish to a USK to write a new=0A> message, then read all versions of w= ith the public key to see what=0A> others have written.=A0 Is this even clo= se?=0A=0AThat could work, but it would be problematic. With this kind of ap= proach=0Aone malicious person can spam messages to that single key so that = no one=0Acan reliably send messages.=0A=0AThe problem to solve here is find= ing other identities to fetch messages=0Afrom. My understanding is that FMS= and FLIP (examples of forums and chat=0Arespectively) have a shared key fo= r announcing identities, and after=0Athat each identity inserts messages to= their own private SSK.=0AIndividuals can then be ignored at will, and all = a malicious individual=0Acan do - at least at a key level - is overwhelm th= e announcement=0Amechanism. This is often coupled with a trust/scoring syst= em where in=0Aaddition to publishing messages, identities publish a trust l= ist, and=0Agive bad scores to spammers or those who abuse their trust list.= =0A=0AIf you want to do something like this, you could roll your own identi= ty=0Aannouncement, or make use of an established system like Web of=0A Trus= t=0A(WoT) or Less Crappy Web of Trust (LCWoT). [0][1] WoT provides identity= =0Acreation and announcement. Unlike FMS and FLIP, it does not use a shared= =0Aannouncement key. Instead it ships with a list of trusted "seed=0Aidenti= ties" that already run the software, and add at neutral trust=0Athose who s= olve CAPTCHAs they publish. LCWoT was written due to=0Afrustration with WoT= 's performance and stability, and only supports=0Aestablished identities.= =0A=0A-Steve=0A=0A[0] https://github.com/freenet/plugin-WoT-staging/=0A=0A[= 1] https://github.com/tmarkus/LessCrappyWebOfTrust=0A=0A=0A________________= _______________________________=0ATech mailing [email protected]= rg=0Ahttps://emu.freenetproject.org/cgi-bin/mailman/listinfo/tech ---876742037-932695504-1384247256=:77492 Content-Type: text/html; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable <html><body><div style=3D"color:#000; background-color:#fff; font-family:He= lveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;fo= nt-size:10pt"><div id=3D"yiv5521579630"><div><div style=3D"background-color= : rgb(255, 255, 255); font-family: HelveticaNeue, 'Helvetica Neue', Helveti= ca, Arial, 'Lucida Grande', sans-serif;"><div id=3D"yiv5521579630yui_3_13_0= _8_1384062362554_8" style=3D"color: rgb(0, 0, 0); font-family: HelveticaNeu= e, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-si= ze: 10pt;">Thanks for the response! All good information. Its f= un to think about how to build a system with the very specific constraints = that Freenet imposes.</div><div id=3D"yiv5521579630yui_3_13_0_8_13840623625= 54_8" style=3D"color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica = Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;"><br= ></div><div id=3D"yiv5521579630yui_3_13_0_8_1384062362554_8" style=3D"color= : rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucid= a Grande', sans-serif; font-size: 10pt;">I'm not building a messaging appli= cation per se, but users will need to communicate and most identities will = not be very long-lived. This is leading me towards thinking I can get= away with a single key to announce new messages. I was also thinking= about adding a Nonce to the message combined with an expensive hashing alg= orithm (i.e. BCrypt) so spamming a user takes some work on the spammer's si= de. </div><div id=3D"yiv5521579630yui_3_13_0_8_1384062362554_8" style= =3D"color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', Helv= etica, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;"><br></div><div= id=3D"yiv5521579630yui_3_13_0_8_1384062362554_8" style=3D"color: rgb(0, 0,= 0); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucid= a Grande', sans-serif; font-size: 10pt;">A sender would create a message similar to:</div><div id=3D"yiv5521579630yui_3_13_0_8_1384062362554_8" sty= le=3D"color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', He= lvetica, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;"><br></div><d= iv id=3D"yiv5521579630yui_3_13_0_8_1384062362554_8" style=3D"color: rgb(0, = 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Luc= ida Grande', sans-serif; font-size: 10pt;"><span style=3D"font-size: 10pt;"= >Sender <- my public identifier</span><br></div><div id=3D"yiv5521579630= yui_3_13_0_8_1384062362554_8"><div id=3D"yiv5521579630yui_3_13_0_8_13840623= 62554_8">Recipient <- recipient's public identifer</div><div id=3D"yiv55= 21579630yui_3_13_0_8_1384062362554_8"><span style=3D"font-size: 10pt;">Nonc= e <- unique value to this recipient from the sender for this message</sp= an><br></div><div id=3D"yiv5521579630yui_3_13_0_8_1384062362554_8">SenderSi= gnature <- sender signs message with (recipient, nonce) to ensure sender= is who he says he is</div><div id=3D"yiv5521579630yui_3_13_0_8_1384062362554_8"><spa= n style=3D"font-size: 10pt;">AntiSpamHash <- Bcrypt(recipient, nonce, mi= nimum_rounds) to force some work on the sender</span><br></div><div id=3D"y= iv5521579630yui_3_13_0_8_1384062362554_8">MessageBodyId <- location of s= igned/encrypted message body located at a different Freenet key</div><div s= tyle=3D"color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', = Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;"><br></div>= <div style=3D"color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica N= eue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;">As a= receiver checking for incoming messages, he only fetches the message body = for messages that:</div><div style=3D"color: rgb(0, 0, 0); font-family: Hel= veticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif= ; font-size: 10pt;"><br></div><div style=3D"color: rgb(0, 0, 0); font-famil= y: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-s= erif; font-size: 10pt;">* Have himself as the recipient</div><div style=3D"= color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', Helvetic= a, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;">* Have a unique No= nce from the sender (no duplicates to avoid signature / anti-spam value ste= aling)</div><div style=3D"color: rgb(0, 0, 0); font-family: HelveticaNeue, = 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size:= 10pt;">* Correct signature at SenderSignature</div><div style=3D"color: rg= b(0, 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial,= 'Lucida Grande', sans-serif; font-size: 10pt;">* Correct AntiSpamHash</div= ><div style=3D"color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica = Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;"><br= ></div><div style=3D"color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size= : 10pt;">If all of these match, the receiver will then retrieve the message= body.</div><div style=3D"color: rgb(0, 0, 0); font-family: HelveticaNeue, = 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size:= 10pt;"><br></div><div style=3D"color: rgb(0, 0, 0); font-family: Helvetica= Neue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font= -size: 10pt;">I think the above scheme will allow for looking at the shared= key pretty quickly, and a computationally expensive AntiSpamHash will disi= ncentivize large amounts of spam. Definitely not perfect but it may b= e good enough for my needs.</div></div><div class=3D"yiv5521579630yahoo_quo= ted" id=3D"yiv5521579630yui_3_13_0_8_1384062362554_10" style=3D"display: bl= ock;"> <br clear=3D"none"> <br clear=3D"none"> <div class=3D"yiv5521579630y= ui_3_13_0_1_1384062362554_15116" style=3D"font-family: HelveticaNeue, 'Helv= etica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;"> <= div class=3D"yiv5521579630yui_3_13_0_1_1384062362554_15117" style=3D"font-f= amily: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', = sans-serif; font-size: 12pt;"> <div class=3D"yiv5521579630yqt0784170282" id= =3D"yiv5521579630yqtfd33506"><div dir=3D"ltr"> <font size=3D"2" face=3D"Ari= al"> On Sunday, November 10, 2013 2:38 PM, Steve Dougherty <steve@askste= ved.com> wrote:<br clear=3D"none"> </font> </div> <div class=3D"yiv5521= 579630y_msg_container">On 11/10/2013 12:45 AM, Michael Pearce wrote:<br cle= ar=3D"none">> Hi Steve.<br clear=3D"none">> <br clear=3D"none">> I= 'm using Ruby and the library for Ruby is... well... a little out of<br cle= ar=3D"none">> date. There were a couple of quick changes to make (= syntax for Ruby<br clear=3D"none">> 1.9 and library changes), but i was = having a hard time getting things<br clear=3D"none">> to work with makin= g a blocking request... Since i really want to do<br clear=3D"none">> just a f= ew simple things, i'll most likely roll my own library and<br clear=3D"none= ">> publish as a Ruby Gem.<br clear=3D"none"><br clear=3D"none">Alright,= sounds good.<br clear=3D"none"><br clear=3D"none">> I did have another = question: How do applications such as a "chat"<br clear=3D"none">> work?= The only way that I could think of is to have multiple clients<br cl= ear=3D"none">> sharing the same SSK private key, publish to a USK to wri= te a new<br clear=3D"none">> message, then read all versions of with the= public key to see what<br clear=3D"none">> others have written. I= s this even close?<br clear=3D"none"><br clear=3D"none">That could work, bu= t it would be problematic. With this kind of approach<br clear=3D"none">one= malicious person can spam messages to that single key so that no one<br cl= ear=3D"none">can reliably send messages.<br clear=3D"none"><br clear=3D"non= e">The problem to solve here is finding other identities to fetch messages<br clear=3D"none">from.= My understanding is that FMS and FLIP (examples of forums and chat<br clea= r=3D"none">respectively) have a shared key for announcing identities, and a= fter<br clear=3D"none">that each identity inserts messages to their own pri= vate SSK.<br clear=3D"none">Individuals can then be ignored at will, and al= l a malicious individual<br clear=3D"none">can do - at least at a key level= - is overwhelm the announcement<br clear=3D"none">mechanism. This is often= coupled with a trust/scoring system where in<br clear=3D"none">addition to= publishing messages, identities publish a trust list, and<br clear=3D"none= ">give bad scores to spammers or those who abuse their trust list.<br clear= =3D"none"><br clear=3D"none">If you want to do something like this, you cou= ld roll your own identity<br clear=3D"none">announcement, or make use of an= established system like Web of=0A Trust<br clear=3D"none">(WoT) or Less Cr= appy Web of Trust (LCWoT). [0][1] WoT provides identity<br clear=3D"none">c= reation and announcement. Unlike FMS and FLIP, it does not use a shared<br = clear=3D"none">announcement key. Instead it ships with a list of trusted "s= eed<br clear=3D"none">identities" that already run the software, and add at= neutral trust<br clear=3D"none">those who solve CAPTCHAs they publish. LCW= oT was written due to<br clear=3D"none">frustration with WoT's performance = and stability, and only supports<br clear=3D"none">established identities.<= br clear=3D"none"><br clear=3D"none">-Steve<br clear=3D"none"><br clear=3D"= none">[0] <a rel=3D"nofollow" shape=3D"rect" target=3D"_blank" href=3D"http= s://github.com/freenet/plugin-WoT-staging/">https://github.com/freenet/plug= in-WoT-staging/</a><div class=3D"yiv5521579630yqt2883222496" id=3D"yiv55215= 79630yqtfd18893"><br clear=3D"none">[1] </div><a rel=3D"nofollow" shape=3D"= rect" target=3D"_blank" href=3D"https://github.com/tmarkus/LessCrappyWebOfTrust">https://github.co= m/tmarkus/LessCrappyWebOfTrust</a><div class=3D"yiv5521579630yqt2883222496"= id=3D"yiv5521579630yqtfd24784"><br clear=3D"none"></div><br clear=3D"none"= ><div class=3D"yiv5521579630yqt2883222496" id=3D"yiv5521579630yqtfd68668">_= ______________________________________________<br clear=3D"none">Tech maili= ng list<br clear=3D"none"><a rel=3D"nofollow" shape=3D"rect" ymailto=3D"mai= lto:[email protected]" target=3D"_blank" href=3D"mailto:Tech@freenetp= roject.org">[email protected]</a><br clear=3D"none"><a rel=3D"nofollo= w" shape=3D"rect" target=3D"_blank" href=3D"https://emu.freenetproject.org/= cgi-bin/mailman/listinfo/tech">https://emu.freenetproject.org/cgi-bin/mailm= an/listinfo/tech</a></div><br clear=3D"none"><br clear=3D"none"></div> </d= iv></div><div class=3D"yiv5521579630yqt0784170282" id=3D"yiv5521579630yqtfd= 23966"> </div></div><div class=3D"yiv5521579630yqt0784170282" id=3D"yiv5521= 579630yqtfd02499"> </div></div><div class=3D"yiv5521579630yqt0784170282" id=3D"yiv5521579630yqtfd19802" style= =3D"color: rgb(0, 0, 0); font-family: HelveticaNeue, 'Helvetica Neue', Helv= etica, Arial, 'Lucida Grande', sans-serif; font-size: 10pt;"> </div></div><= /div></div></div></body></html> ---876742037-932695504-1384247256=:77492-- --===============0625413170== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Tech mailing list [email protected] https://emu.freenetproject.org/cgi-bin/mailman/listinfo/tech --===============0625413170==--