Will some crypto apis available in next version

alexzheng

It is said that next version will support encrypt compiled lua file.
I wonder if there will be some digest and encrypt/decrypt apis added.

Just as this library:
http://mkottman.github.com/luacrypto/manual.html#reference

I do not kown whether this library is the best choice.

It took not much effort to implement an iOS plugin for gideros with this ios-openssl and the above library

https://github.com/st3fan/ios-openssl

But after using these apis, I lost the Convenience of debug on pc player.

So guys, will you vote for add encrypt/decrypt apis in official version.

plamen

Yeah, i realized that there is no point to crypt my player stats file when Lua code is open and this leads to no IAP for me because tools like iExplorer make hacking player stats easy as joke. That's why i think crypted Lua files is most important feature to come.

semp

Yeah, I agree to this. We need a cool Gideros encryption helper.

alexzheng

any plan? if not, I will use a plugin instead.

atilim

But I think OpenSSL is overkill to encrypt/decrypt some data and files. Any AES implementation (e.g. https://github.com/bighil/aeslua) should do the work.

moopf

@atilim - I think the point is that the Lua source files need to be encrypted to make it more difficult for people to work out how the code works and easily bypass player stats, such as IAP virtual currency etc. If the Lua source code is encrypted we can then encrypt our save files to do this - without encrypting the Lua source code it's pointless encrypting save data.

ar2rsawseen

@moopf hmm how about all the files that will be stored in documents folder?

atilim

@moopf - Totally agree. I'll implement encryption of Lua files. So that anybody can use a symmetric key algorithm (like AES) to encrypt his/her data while holding the key inside an encrypted Lua file.

And most probably encryption of Lua files will be only available to paid users.

moopf

@ar2rsawseen - Doing it that way there wouldn't be an option to store the key securely (unless Gideros used a standard key which kind of defeats the point!)

@atilim - Yup, sounds good. I agree about only making it available to paid users as well - I think that's perfectly reasonable.

atilim

unless Gideros used a standard key which kind of defeats the point!

@ar2rsawseen, @moopf - btw, did you see this? https://plus.google.com/101700526665328331501/posts/Yk71MgkvAXx

mefisto

@atilim this is an interesting method

moopf

@atilim - hahaha, that's hilarious

gorkem

Love those marketing blurb :P Atilim, we have to copy that!

atilim

@gorkem hahaha. only if we invent the most virtually uncrackable method

ar2rsawseen

It's actually texts like virtually uncrackable what makes other even more curious to crack it

alexzheng

That's great!

But I think OpenSSL is overkill to encrypt/decrypt some data and files. Any AES implementation (e.g. https://github.com/bighil/aeslua) should do the work.

Yes, totally agree! it make the final ipa file a little bigger, but not too much.
What I need to use it is just making a digest.

And btw,can you recommend an libary for digests such as MD5, SHA-1, HMAC, etc.
Best performance and most lightweight.

So many in the list, has anybody used some of these?
http://lua-users.org/wiki/CryptographyStuff

alexzheng

After looking into some of these, I think the [md5] lib is not bad.

plamen

@atilim: Do you think implementing this will be lot of trouble and work? http://www.keplerproject.org/md5/ And +1 for encrypted lua files for paid accounts.

moopf

On encrypting your player data, I've always been amazed at how some games don't even take this into account, even when using IAP. For example, Tiny Tower is actually incredibly easy to cheat at:

http://tinytowerwiki.com/Cheating

atilim

@plamen I haven't known such a good library exists and it seems it's really easy to add as a plugin. And because it's a part of kepler project, we can assume it's well written and stable.

plamen

@atilim. I hope it will be easy to port. The license is same as Lua so shouldn't be a problem. I guess