Re: PBM die rolling web site

From: bruno@cerberus.csd.uwm.edu (Bruno Wolff III)

Date: Thu, 11 Dec 1997 00:00:00 +0000

From article <348FE56C.47D9@irony.com>, by Ed Taychert <elt-notreally@irony.com>:
>
> A signature from the originator sounds good, but the roll
> can not go to the requester's site to get signed... the requester
> could "veto" a roll. Instead, you need a protocol exchange where
> a "cookie" was sent, signed, returned, and then included in the
> rest of dice roll email. Commercial systems go that far, but
> I think that's a bit much for a dice roller to do.
>
>  - Ed.
>

There are a couple of ways to handle this depending how the die roller is
being used.

One is to have the die roller verify a signature on a request before making
a roll. This is a good model for play by mail games with a moderator.
The moderator will want to verify that all commands are in fact sent by
the appropiate person.

Another alternative is to have the requester send a pgp signed message
to the die roller that is included with the returned rolls. The signature
should also be over the list of recipients of the roll so that that can't
be forged later.

There are even cases where you don't want to send out signed rolls, because
that allows trusted information exchange when it shouldn't be allowed.
This is most likely going to happen in moderated multiplayer games. In
cases where people are not supposed to be able to verify certain kinds
of information, but are allowed to make claims about it, you can't send
them information pgp signed by the moderator. Instead you need to send them
a message encrypted with there public key. Part of the message indicating
that this is a message sent to them by the moderator program (including
a unique key that won't be reused for other messages) is signed by the
moderator. The actual data relating to the game isn't signed. That way
this data can only be trusted by the player receiving it. If there is
another trusted (by two conspiring players) that can receive mail to
one of the players and then pass a certified copy to the other, then
it is still possible to exchange information securely.
--
I do not accept mail from sites that have trouble controlling spam.

References

Re: PBM die rolling web site
Ed Taychert <elt-notreally@irony.com>
Thu, 11 Dec 1997 00:00:00 +0000