osAESEncrypt/osAESDecrypt using key in environment variable i added function osGetEnvironmentVariable(string key) so i could store secret in env instead of hard-coding script :)
we don't have a built-in RFC HMAC so we can use a non-standard sig like in the example below or make osHMAC() function (i already did that if you want the code lemme know)
we use a unix timestamp to thwart off replays
i'm setting env var in my opensim.service systemd unit file, you could do it a different way if you want
i set perms for osGetEnvironment, osAESEncrypt/To, os AESDecrypt/From to GRID_GOD (user level >= 200) - in ini- that should be a good idea, you can do as you wish
OpenSim/Region/ScriptEngine/Shared/Api/Implementation/OSSL_Api.cs:
public LSL_String osGetEnvironmentVariable(string key)
{
if(string.IsNullOrEmpty(key))
return LSL_String.Empty;
string? ret = Environment.GetEnvironmentVariable(key);
if (!string.IsNullOrEmpty(ret))
{
return ret;
} else {
OSSLShoutError("osGetEnvironmentVariable: Failed to get environment variable!");
return LSL_String.Empty;
}
}
OpenSim/Region/ScriptEngine/Shared/Api/Interface/IOSSL_Api.cs:
//ApiDesc Get System Environment Variable (string key). Returns string.
LSL_String osGetEnvironmentVariable(string key);
Shared/Api/Runtime/OSSL_Stub.cs:
[MethodImpl(MethodImplOptions.AggressiveInlining)]
public LSL_String osGetEnvironmentVariable(string key)
{
return m_OSSL_Functions.osGetEnvironmentVariable(key);
}
config-include/osslEnable.ini
Allow_osGetEnvironmentVariable = "GRID_GOD,"
Allow_osAESEncrypt = "GRID_GOD,"
Allow_osAESEncryptTo = "GRID_GOD,"
Allow_osAESDecrypt = "GRID_GOD,"
Allow_osAESDecryptFrom = "GRID_GOD,"
/etc/systemd/system/opensim.service:
[Service]
Environment=MYBIGSECRET=FooYeah
script in prim:
default
{
state_entry()
{
}
touch(integer n)
{
// AES encryption with HMAC signing
string secret = osGetEnvironmentVariable("MYBIGSECRET");
// build payload
string msg = "a dime a dozen";
//avoid replay
string ts = (string)llGetUnixTime();
string plaintext = llList2Json(JSON_OBJECT, [
"msg", msg,
"ts", ts
]);
string ciphertext = osAESEncrypt(secret, plaintext);
// HMAC sig [not RFC HMAC - so it's vulnerable, would need to make osHMAC() func using System.Security.Cryptography
string sig = llSHA256String(ciphertext + "|" + ts + "|" + secret);
string payload = llList2Json(JSON_OBJECT, [
"data", ciphertext,
"ts", ts,
"sig", sig
]);
llOwnerSay("the secret: " + secret);
llOwnerSay("the payload: " + payload);
string decrypted = osAESDecrypt(secret,ciphertext);
llOwnerSay("decrypted: " + decrypted);
}
}
output:
[18:55] Object: the secret: FooYeah
[18:55] Object: the payload: {"data":"035BD37FF5EEBC778050625D0D11084A:ab3ab4619621ce8ece1259da3222c97c517641091b36bb674b777482e51dfe696d61009f8926cee430ebec377d3f05f2","ts":"1776563728","sig":"b233cf71cc3a03430b47061f00bfd1f781028af36b217eb95b58c5dbe9a6e481"}
[18:55] Object: decrypted: {"msg":"a dime a dozen","ts":"1776563728"}
| niki stuart: whooooooooooooooooooooooooooooooooooooosh 30 minutes ago |