@EllaRose so I was thinking it might be easier to follow if you named the routines something like send_token and recv_token

just to emphasize that it's the only part that needs to hit the wire

ok, thank you, I'll take a look at doing it that way

sorry I haven't gotten to work on it much, it's been a hot and relatively unproductive day so far

@EllaRose I'm still trying to force myself to dredge through code implicitly broken by an overall structural change

oh it's ok

don't worry about it :)

I'll figure it out eventually, I hope I didn't suck up tons of your time by having you look at it

not at all, I just am making slow progress I think because I feel like there's "boring" code looming over my head that I really need to get done to get to another fun part lol

pretty sure I've been there at least 100 times before

I find making new stuff to be exponentially more fun then fixing old/broken things

@EllaRose if you use that thing, you have to know how to hack it, so if you have a "static-static" secret S then you can take a random K and send a valid token with pow(S, K, P), and decode their token with pow(T, K, P) to spoof the session

only thing is, that key exchange actually takes place inside a tls-protected session

i'm not sure how that might complicate a concrete attempt to do stuffs like that

if someone can get in the middle, the attack still applies

I'd like to make it host proof

also, if someone can initiate a connection with either party the attack applies

@EllaRose as long as the static secret is safe, then you'd have to break CDH assumption to break the protocol

either private key can generate it using the other public key

or I should be more technically accurate, either public key can generate it, by raising it to the other private key

well, the way my system works, is that there is the data transfer service (the post office), and then data transfer clients. The clients can send mail to other clients via the dts, but the dts has no ability to initiate interaction with the clients. Clients must poll the dts and ask for their mail

so right now I have tls for the client->dts connection

and where your stuff comes in is attempting to secure the mail from client->dts->client

so I'm hoping that if I can create a system where it's host proof then anyone/everyone can be the mailman, because you don't have to trust them

I love that concept of encapsulated packets that anyone can carry for you :D

"end to end encryption" is the buzz word right?

yeah, too bad it's not really good enough :|

Well what's wrong with it?

well, end to end encryption is what I have already, what with tls protecting the connection from each client to the dts server

the problem is the decryption of material at the dts server imo

you have to trust the mailman to not pilfer your packages or forge them or whatever

@EllaRose lol only if you consider the client and the server the "ends"

I meant it with the message sender and recipient being the "ends"

in that sense, then heck yeah it's awesome

Ella.

Ofc it's awesome!

thinking of how it's somewhat readily available, specifically, you can sorta just go grab ready made secure software for many tasks and even libraries implementing all the primitives in basically any language

@EllaRose equip your damn users with PKI!

If you just had a keyserver life would be so much easier :P

yeah I've been wondering about how to handle that

couldn't come up with anything better then what tls does =\

I went with the "homebrew certificate authority" approach

I have that right now just to get stuff to work

my command line runs on the rpc portal that powers my dts (python ssh basically)

so in order to run it at all it needs tls + certs

ultimately it's just easier to write everything this way cause then I only have to do it once and the networked part happens automagically

my desktop functions that way also, client sends clicks and keypresses and stuff and the server processes it, and sends back rendering instructions

so now any apps I write have multi-player builtin, as it were

@EllaRose I get a feeling you might enjoy to code all of the things

I did spend an awful lot of time writing a program for writing other programs ;)

I too, enjoy to code all of the things

I don't know why it didn't hit me before but I think we should merge our language projects lol

You seem to be going for the fully featured API, I have a project where I'm shooting for the fully featured compiler :P

that would be pretty awesome and anything you would like to collaborate on I'm pretty much up for!

well I seriously love manipulating program trees with graph algorithms, and I can't get enough of JIT machine code generators

I try to avoid modifying the language itself because of how it modifies the learning curve

but I have made a preprocessor and extensible keywords

but those are the big guns, as it were, and rarely get used

I did make an "improt" keyword like a week ago

that silently deletes the module you attempted to import but made a typo when doing so

(not enabled by default!)

We'll build all that stuff in lol, I was just thinking about how I need to put that code online open source so it doesn't rot when it's somewhat usable and only needs minimal work to be pretty good

I did all the "fun parts" like recursive dependency resolution on program trees and variable lifetime analysis

I've written code generators of all kinds for the different evolutions of it, lol even generators that target a weird "platform" that is half server PHP half client JS

but when it comes to the API, I go "ugh" and kinda just try to write a script to auto-generate some bindings for some other standard libraries

that's not a bad approach to be honest

so you develop your own language or ?

I have a language that... I'm sorry, it feels like a C++ or C# type of thing lol

I don't get what you mean?

just the symbols used, { } instead of inferring from whitespace

oh right

well, that's clearly your native tongue, so to speak

things like arrays are probably actually more familiar to you

so no surprises there

I did them all dynamic feeling

so can I see it? :D

I guesssss I always leave stuff broken if I have that luxury :P

I guess I'll just make a repo for it

no worries, I will probably only have time to be impressed, and not nearly enough to scrutinize bugs I won't encounter myself soon

lol we're gonna have to make a separate room for all this pretty soon

@EllaRose github.com/micklh/Lazy

liking the name already

lol oops, the syntax highlight file is ripped from an older programming language project, just noticed I never fully updated that

I did some serious preprocessor abuse in there lol

Part of the build script does some ugly perl on the source to get a list of symbols out that go into a generated include before compiling. Then these foul macros take over from there: github.com/micklh/Lazy/blob/master/include/Ptr.h

can I see some demo Lazy programs?

I hadn't even thought about compiling it :o

Well I went ahead and made a plot to see if it gives any hints on how the running time scales with the bit width....

dafuq -_-

that's really interesting, how many runs did it take to generate that data?

I only did about 4 runs for each size

but there was almost no variance, they all agreed to within 1 second

I would be less baffled if it were just random looking, but those interpolations between the spikes... wtf!

indeed, I would opt for a 224 bit width then I think

well luckily, it's the only step with such unpredictable timing, once the group parameters are chosen then can just be re-used by everyone

at least, until someone gets a Logjam style DB generated for it, but hopefully I can generate alternate sets of parameters faster than they can produce those DBs :P