UDP Encryption about quilkin HOT 9 OPEN

• https://github.com/RustCrypto - Rust implemented encryption libraries
• netcode.io spec for encryption - they use libsodium for encryption. I swear I found some pure rust libsodium implementations, but now I can't find them again. - found it: https://crates.io/crates/crypto_box, and there are good bindings for libsodium.
• DTLS discussion - #30

from quilkin.

I think we should seriously look at implementing curvecp in rust and using it for our needs, the spec is detailed at http://curvecp.org/ and we should at least go over it and see if its viable for us

from quilkin.

There is a poc implementation of curvecp here: https://github.com/sovrin-foundation/rust-curvecp-poc

from quilkin.

I didn't realise it, but QUIC has an unreliable packet extension, which is implemented by Quinn

• https://tools.ietf.org/html/draft-pauly-quic-datagram-05
• https://github.com/quinn-rs/quinn

And quinn is built on Tokio, so same async stack.

from quilkin.

Reviewing https://github.com/ValveSoftware/GameNetworkingSockets

Encryption. AES-GCM-256 per packet, Curve25519 for
key exchange and cert signatures. The details for shared key derivation and
per-packet IV are based on the design
used by Google's QUIC protocol.

from quilkin.

How easy is it to port libsodium around? (It is used in netcode.io so I'm figuring it's pretty good?)

Getting a lot of internal feedback that "to be secure, the libraries have to reach for at least C to have appropriate functionality" - so rusttls is fine, bindings to libsodium, bindings to BoringSSL for example would be ideal.

from quilkin.

Getting lots of push from security folks I pinged to use BoringSSL or a variant - so https://github.com/google/mundane might be a good fit, or https://github.com/briansmith/ring directly.

(Just throwing this all down so I don't forget it)

from quilkin.

How is this issue different from #30? Seems to me that DTLS is UDP encryption.

from quilkin.

How is this issue different from #30? Seems to me that DTLS is UDP encryption.

Given that there's really no standard for UDP encryption for games -- I think it makes sense to track separately. There are probably several encryption possibilities we could discuss and examine for UDP security (I expect once we release there will be many opinions on this) - one of which being DTLS.

from quilkin.