Yes, I wasn't really considering that EVERYTHING would be encrypted or authenticated... My only interest in GPG was that it would provide a GUID (the public key) that could not possibly be spoofed or stolen.
The standard way to protect EVERYTHING (as in IPSec or TLS) is to use public key agreement protocol (10's of milliseconds) to establish a session key, and then use the session key to authenticate traffic using HMAC (sub-milliseconds). Not that there is a crying need to authenticate normal player traffic, but all privileged (admin) actions would benefit from session authentication.
Caveman makes lots of good points, but this:
A failsafe way to ID a player, one that can not be spoofed.is not one of them. Public key authentication
is a failsafe way to ID a player that cannot be spoofed, unless you can hack that player's computer to steal his private key. USB tokens or smartcards address that problem. Because Tremulous doesn't have much of intrinsic value (admin privileges are fun, but don't hit you in the pockebook like online banking or shopping) there is not a huge incentive to spoof an existing ID. The problem addressed by invites, whitelists, eBay-like reputations, pay-per-ID, etc, is the ability to mint an unlimited number of new IDs at very low cost. As long as minting IDs is easy, there is little incentive for a griefer to spoof someone else's ID. If Tremulous had a mechanism for adding value to IDs, griefers would have more incentive to steal an existing ID rather than minting a new one, and authentication would then be needed.
So what is an appropriate way to add value to Tremulous IDs? Reputation, in my opinion. This would involve:
* Each server operates a reputation system (like Dretch*Storm's experience points - XP) according to its own formula. Griefing would be penalized by reducing XP for successful votekicks, admin kicks, and bans of various duration. The server operator could link in-game reputations with forum reputations (post counts or member ranks) to make it more difficult to quickly mint new in-game IDs. A server could require pay for play (although I certainly wouldn't pay simply for the privilege of avoiding griefers and I doubt such a server would succeed). Much better would be inferred payment: require registration through an institutional email account (isp-provided, .edu or corporate, but not hotmail/gmail/yahoo). A griefer might have access to a few such addresses (Verizon permits 8 email addresses per account) but not an unlimited supply.
* Each server publishes its reputations using a standard (to-be-defined) interface which any other server could query. There is no need for a centralized "ban" server, the existing master server allows a server to find all other servers that send a heartbeat. The reputation query would contain a GUID; the response would contain the public key used to authenticate that GUID and the reputation info.
* Each server would collect reputations from every other server it cared to check (valuing the opinions of some servers more than others). It would then make a decision to admit or deny a player using its own criteria.
A crucial point of this scheme is federation: there is no central authority for making ban decisions. Instead there is an information sharing federation in which every server is sovereign: it publishes what it chooses to publish, and makes whatever decisions it wishes based on information published by others.
A second crucial point is that because new GUIDs can be minted and because, if per-server GUIDs are used, a player can choose which GUIDs to disclose and thus which servers' reputation info can be linked to the player, THERE IS NO VALUE in attempting to rely on negative reputations as a reliable way of detecting griefers. Caveman is absolutely correct on this point: a GUID does not ID a player unless he wants it.
So why bother?
Because if there are a few well-admined servers that limit GUID minting somehow (e.g. by requiring registration from a paid email address) and choose to share their users' XP info, then they would be able to leverage each others efforts. Perhaps the federation would grow in popularity, or perhaps good (well-intentioned, whether skilled or noob) players would migrate to more griefer-friendly servers. Hard to say without trying.
