ValveSoftware / ValveSoftware/GameNetworkingSockets

Basic authentication is not really possible to get working with manually-issued certs

Open
#237 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
C++
Stars
9.9k
Forks
749
Avg merge
1d 2h
Merged PRs (30d)
1

Description

From my quick look at code, i found out that there is key exchange public key signing in source, but no way to set keys for it are provided in the interface. (It is possible to set them through certificates, but certificates don't look like they are made for usage outside Steamworks).
And my question is: can i set keys for signing and verifying key exchange public keys using only interface?
If no, i think it's worth considering adding some simple API for that, for example:

AddKeyExchangePublicKeys(CECSigningPublicKey* keys, size_t keyCount);
SetKeyExchangePrivateKey(CECSigningPrivateKey key);

(CECSigningPublic/PrivateKey are here for example)
I think, it will improve protection against MITM.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the source's key-exchange public-key signing path and the existing certificate-based interface mentioned in the issue. Determine whether signing and verification keys can be configured through the current interface; if not, scope an API for them and define how its MITM-protection behavior would be validated.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.