将本实验室的通信计划命名为巴比伦塔,典故来自《蓝宝石之谜》(The Secret of Blue Water)。 在这部动漫著作中,巴比伦塔是亚特兰蒂斯人与母星通信的设备,当然后来被用作强大的粒子束武器。

The name of our communication system’s project is called Babeltower, which comes from The Secret of Blue Water. In this anime series, the babeltower is original used by the Atlantians for communicating with the mother planet, which has been later solely used as a powerful particle weapon.

某种意义上讲,本实验室的这一通信计划目标,一整套通信系统和密码机制,和巴比伦塔也是很像的。 不仅是因为都占了“通信”这两个字,密码本来就_曾经_是军火(受美国军火出口管制的政策限制)。 是好是坏,自然由人来掌握。NeoAtlantis的目标,只是将它开发出来。

From some aspects, our goal of this plan, to build a complete communication system and to construct a complete cipher system, is similar to the babeltower. Not only for both are used for communicating, but also regarding the fact, that cipher were really weapons. They have been once under the restriction of exporting in US. Whether it is good or not, is a matter of philosophy. Our goal is only the completion.

背景播放的是《蓝宝石之谜》中发射巴比伦之光时的音乐。这一音乐的出现,正在巴比伦塔设定目标、校准、瞄准并同时接受和蓄积电力的过程。 本音乐是属于蓝宝石之谜中的巴比伦塔的,不属于什么奇怪的Q版里面骨架一样的战舰!!

The background music is used in The Secret of Blue Water when the babel’s light is being launched. At the mean time, the babeltower is tracking the target, calibrating itself, and being charged. The music belongs to the babeltower, not some weird spacecraft in some weird film named Q!

结构图

第一期工程:密码核心 / Project 1: Cryptographic Core

密码核心,代号Orichalkum(在动漫中巴比伦塔运转所必须的神奇晶体,实际上是集成度非常高的光子计算机一类的东西), 是一个设计上可用来自动或与人互动地完成加密、解密、签名、验证等任务的独立计算机单元。 而最关键的部分,是用javascript实现的一个库,neoatlantis-crypto-js。有了这个库,可以很容易构造兼容的密码系统。

The cryptographic core, code named Orichalkum(the necessary crystal for running the babeltower, which is a compact photon computer or something), is by design a self-contained computer unit, which encrypts, decrypts, signs and verifies automatically, or interactively with human. The most important part is a javascript library named neoatlantis-crypto-js, with which a similar cryptographic could be built easily.

  • 关于neoatlantis-crypto-js的说明请见这里。这个说明书写得十分详细,这里不再赘述。
  • 密码核心可以从neoatlantis-crypto-js这个库的部分功能直接扩展而来。关于如何扩展,请关注上面给出的说明地址。 Orichalkum(特指本计划中用这个库开发的密码核心实现)此外需要做的是:
    1. 单独维护一个由用户身份、密码等信息保护的数据库,之后可用傀儡密码操作neoatlantis-crypto-js来保存新密钥等,以便绕开具体使用中多次认证。
    2. 密码核心负责编辑和展示外界输入的请求及其处理结果。密码核心对外界的计算机暴露一系列API,据此外界的计算机可以输入offer来告知用户可以通过回答这个offer来递送消息。 用户向offer中填写的数据来自草稿。密码核心的数据库也保存用户拟定的草稿。草稿可以快速加载。
    3. 整个密码核心由HTML5+javascript编写,此外维护一个由python+pyqt4(利用qt中的webkit内核)完成的全屏浏览器,来显示密码核心。 全屏浏览器中可利用python的优势汇聚一些速度较快或者性能较好的函数。例如更好的伪随机数发生器,甚至真随机数发生器。
  • 硬件上,密码核心可以利用树莓派(Raspberry Pi)制作,也可以只是一台独立的计算机。在调试开发过程中,也可能是虚拟机。
    • 如果用户有额外的计算机用于部署密码核心,那么他可以制作例如Tails的usb启动盘:
      • 然后将密码核心的程序存储在上面的一个加密分区中。
      • 已经验证,Tails系统自带的python和pyqt4可以用来运行密码核心的基础——一个webkit内核的全屏浏览器。
      • 在紧急情况下,只要拔出密码核心的usb盘,计算机就会自动关闭(Tails操作系统的特性)。 这将清空内存。由于密码核心是加密存储的,再次读取U盘也不会泄密。
  • A comprehensive description on neoatlantis-crypto-js is here.
  • The cryptographic core can be simply extended from this library without much effort. Read the description above for how to do it. Other tasks are:
    1. Maintain a databased protected under user info and passwords. A dummy password is given to the library for saving public keys(identities), avoiding frequent authentications on users for decrypting secret keys(as long as the database is successfully decrypted, we consider the user have been authencitated).
    2. The cryptographic core provides editing and displaying features for external inputs and their proceeded results. APIs from this core are exposed, with which the external computer inputs offers for transmitting messages. Users can answer these offers by filling plaintext, either from pre-edited drafts, or on the fly. The cryptographic core also manages the drafts, which can be loaded quickly to each offer.
    3. The whole cryptographic core is written in HTML5+Javascript. A fullscreen browser written with python+qt4(utilizing qt4-webkit) is also maintained to run the cryptographic core. By using a python customized fullscreen browser, we may provide the library with some enhancement, e.g. a true randomness generator.
  • The hardware of the cryptographic core can be Raspberry Pi, or just another independent computer, or a Virtual Machine(VM) when debugging.
    • If the user decides to deploy this cryptographic core simply on another computer, he may do a Tails USB bootable disk:
      • and save the core in an encrypted partition on it.
      • It is confirmed that the python+qt4 environment shipped with Tails can be used to run the fullscreen browser.
      • Under emergency, as Tails is so designed, people just pull out the USB disk, and the running Tails will shutdown. The memory will be truncated, and since cryptographic core is stored under encryption, it is not possible to read the USB disk to get things out without effort.

当前neoatlantis-crypto-js已经接近完成,尚未进行充分测试。基于此库的密码核心原型正在开发。

Currently, neoatlantis-crypto-js is nearly complete, but has not undergone an adequate test. The prototype of a cryptographic core based on it is under development.

第二期工程:通信计算机 / Project 2: Communicating Computer

通信计算机,代号Babeltower,是一台专门配合密码核心,为其提供经凭多种媒介发送数据的能力的计算机。

The communicating computer, code named Babeltower, is a cooperative computer with the cryptographic core, providing the latter abilities sending data via multiple media.

通信计算机上的软件不被认为是可信的,但是认为是可靠的。即确定其能完成自己声称的功能,不确定在此之外完成非预想的功能。

Softwares on the communicating computer are not considered as trustful, but reliable, i.e. for sure that it completes the stated functionalities, but uncertain if it does others not stated.

第一阶段:浏览器插件 / Step 1: Browser Plugin

设想的解决方案是开发一个浏览器插件,提供将浏览器中的文本框内容作为目标, 通过与密码核心交互产生密文或获取明文的过程。这个插件完成后,在通信计算机上访问Web版本的通信平台, 即可通过插件产生密文,或读取密文。这个Web版本的通信平台可以是基于互联网技术的任何网站。

The solution planned is developing a browser plugin, which provides a feature, that fills the textboxes in the browser with ciphertext, or reads the ciphertext within them, and interacts with the cryptograhic core to do the rest secret things. After completion, on the communicating computer we may just access a web-based communicating platform, and communicate secretly. The platform may be an arbitrary website using Internet technology.

这样,通信计算机也就可以是任意一台能运行例如火狐或者Google Chrome的普通计算机。 它可以和密码核心共用屏幕,放进一个设备箱里,成为专用设备; 也可以只是一台任何人都可以用的PC或者笔记本电脑,在此情况下密码核心将被单独分发。

In doing so, the communicating computer is just another normal computer running Firefox or Google Chrome. It may share the screen with cryptographic core, and being installed into a suitcase as part of a dedicated secure communicating system, or it may just be a PC or laptop that anyone uses, under which cases only the cryptographic core will be distributed.

第二阶段:利用各种底层信道的代理 / Step 2: A Proxy utilizing all methods as underlying channels

本阶段将设计开发一个将Internet流量(例如通过Socks代理获取)转换成可以通过任何信道发送的流量的代理。 利用这一代理程序,通信平台可以通过可配置的插件,利用各种可以想象的信道传送数据到一个服务器上。 由于信道不受限制,远端代理服务器可以隐藏在Tor网络中,提高安全性和生存能力。

In this step a proxy program taking Internet traffic(using Socks protocol, for instance) and converting it into traffic on any imaginable media will be developed. Using this proxy program, the communicating platform will reach the server and transfer its data using pluggable plugins. The remote proxy server can be hidden between Tor network to have its security and surviving ability enhanced.

当前,尚未进行通信计算机的开发。

Currently, the development of communicating computer has not began.