3 files changed, 132 insertions, 0 deletions

diff --git a/docs/updates/Crypto.md b/docs/updates/Crypto.md
new file mode 100644
index 00000000..6b489c3b
--- /dev/null
+++ b/docs/updates/Crypto.md
@@ -0,0 +1,77 @@
+Draft proposal for how crypto will be implemented.
+
+
+Encryption library used: http://nacl.cr.yp.to/
+
+
+When running the program for the first time the crypto_box_keypair() function is used to 
+generate the users public-private key pair. (32 bytes each)
+
+The generated public key is set as the client_id of the peer.
+
+Note that only the crypto connection runs on top of Lossless UDP. The friend requests do not.
+
+Adding a friend
+---------------
+
+Alice adds bob to her friends list by adding his 32 byte public key (client_id) to her friends list.  
+2 cases:  
+case 1: Alice adds Bobs public key and bob waits for Alice to attempt to connect to him.  
+case 2: Bob and Alice add their respective public keys to their friends list at the same time.  
+    
+case 1:  
+Alice sends a crypto request packet to bob with the encrypted part containing the friends request like so:  
+```
+[char with a value of 32][nospam number (4 bytes)][Message]
+```
+
+Ex message: hello bob it's me alice -_- add me pl0x.
+
+For more info on the nospam see: [[Spam Prevention]]
+        
+Bob receives the request and decrypts the message using the function crypto_box_open()
+        
+If the message decrypts successfully:   
+If Alice is already in Bobs friends list: case 2  
+If Alice is not in Bob's friends list and the nospam is good: Bob is prompt to add Alice and is shown the message from her.  
+If Bobs accepts Alice's friends request he adds her public key to his friends list.  
+
+case 2:  
+Bob and Alice both have the others public key in their friends list, they are ready for the next step:   Connecting to an already added friend
+
+In the next step only crypto_box() is used for encryption and only crypto_box_open() for decryption (just like in the last step.)
+
+
+Connecting to an already added friend
+-------------------------------------
+
+Alice and Bob are friends.  
+As soon as they connect they each generate a new keypair which will only be used for the current connection (The session keys).  
+They then send themselves the following packet (the crypto handshake) (encrypted part encrypted with the public nonce in the packet the public key of the receiver and private key of the sender) 
+```
+[char with a value of 02][Senders Public key (client_id) (32 bytes)][Random nonce (24 bytes)][Encrypted message containing: [random 24 bytes base nonce][session public key of the peer (32 bytes)]]
+```
+    
+If the packet is decrypted successfully:  
+Each start using the secret nonce, the public key provided by the other and their own session private key to encrypt data packets (adding to it + 1 for each packet.) 
+Each node sends themselves an empty data packet (data packet with 4 encrypted zero bytes)  
+Data packet:  
+````
+[char with a value of 03][Encrypted data]
+````
+Each data packet received is decrypted using the secret nonce sent to the other (with +1 added for the first packet +2 for the second, etc...) along with the private session key of the receiver.  
+Every data packet sent is encrypted using the secret nonce we received (with +1 added for the first packet +2 for the second, etc...), the session public key of the receiver and the session private key of the sender.  
+    
+The encrypted connection is only deemed successful when the empty data packet is received and decrypted successfully.
+
+
+Crypto request packets
+--------------------------------------
+
+```
+[char with a value of 32][Bob's (The reciever's) Public key (client_id) (32 bytes))][Alice's (The sender's) Public key (client_id) (32 bytes)][Random nonce (24 bytes)][Encrypted message]
+```
+
+The encrypted message is encrypted with crypto_box() (using Bobs public key, Alice's private key and the nonce (randomly generated 24 bytes)) and is a message from Alice in which she tells Bob who she is.
+
+Each node can route the request to the reciever if they are connected to him. This is to bypass bad NATs.
diff --git a/docs/updates/Spam-Prevention.md b/docs/updates/Spam-Prevention.md
new file mode 100644
index 00000000..a0713fd1
--- /dev/null
+++ b/docs/updates/Spam-Prevention.md
@@ -0,0 +1,12 @@
+ 
+Situation 1:
+Someone randomly goes around the DHT sending friend requests to everyone.
+
+Prevented by:
+Every friend address: 
+[client_id (32 bytes)][nospam number (4 bytes)][checksum (2 bytes)] 
+contains a number (nospam).
+
+The nospam in every friend request to that friend must be that number.
+
+If not it is rejected.
diff --git a/docs/updates/Symmetric-NAT-Transversal.md b/docs/updates/Symmetric-NAT-Transversal.md
new file mode 100644
index 00000000..49038216
--- /dev/null
+++ b/docs/updates/Symmetric-NAT-Transversal.md
@@ -0,0 +1,43 @@
+Notes:
+
+Friend requests need to be routed.
+
+The current DHT should be capable of punching all NATs except symmetric ones.
+
+######
+
+Symmetric NAT hole punching:
+
+If we are not connected to the friend and if the DHT is queried and ips 
+returned for the friend are the same but the port is different, the friend is 
+assumed to be behind a symmetric NAT.
+
+Before attempting the procedure we first send a routed ping request to the 
+friend. This request is to be routed through the nodes who returned the ip of 
+the peer.
+
+As soon as we receive one routed ping request from the other peer, we respond 
+with a ping response. 
+
+Ping request/response packet:
+See: Crypto request packets in [[Crypto]]
+
+Message:
+For the ping request:
+[char with a value of 254][char with 0][8 byte random number]
+
+For the ping response:
+[char with a value of 254][char with 1][8 byte random number (The same that was sent in the request)]
+
+As soon as we get a proper ping response from the other we run the different 
+ports returned by the DHT through our port guessing algorithm.
+
+######
+
+Port guessing algorithm:
+
+Right now it just tries all the ports directly beside the known ports.(A better one is needed)
+
+######
+
+We send DHT ping requests to all the guessed ports, only a couple at a time.