character transfer interface

To allow a multi world server landscape there should be a standardized way to transfer characters to different servers to make it easier for players to switch servers. The system should be:

• decentralized
• tampering-proof
• allow control for servers from where they import characters and how

When servers allow to import characters from themself this system can also be used to transfer characters between accounts.

Exporting of characters should be done with the web interface of the server the character is on. The user selects which of their characters they want to export, enters a “character password” (which should differ from the account password) and then they can download an XML file with:

• name
• experience and attributes
• possessions
• (optional) character quest variables
• hash of character password
• URL to public key of the keypair used to sign the character file
• cryptographical signature of the whole file with the private key of the keypair

The player can then use this file to import the character on another server.

To import a character from another server the user uploads the XML file using the web interface of the target server and enters the character password.

Before the server accepts the character it has to check the following:

• The name of the character may not be taken. When it is, the old character has to be deleted first. Allowing to change the name of the character during import would allow character duplication.
• Every server will have a whitelist of public key URLs from which it accepts characters. That way servers can prevent people from importing high level characters from servers with easier gameplay.
• The character password has to match the hash in the file, otherwise the character file might be stolen.
• The cryptographic signature must match the public key. Otherwise the player has tampered with the character file.
• Depending on the key URL the server might apply some additional rules:
  • Not accepting characters above or below a specific level
  • Reducing or increasing experience values to combensate for easier or harder gameplay on the source server
  • Deleting or replacing specific inventory items (the player should be warned about this) which don't exist on the target server or are much harder to get than on the source server
  • Deleting or setting quest variables (for example when the content of the target server is different from the source server)

Export your character, persuade an admin to rename the old character and reimport it. Now you have two identical characters with duplicated money and inventory items. Solution: When renaming a character save a list of previous character names and check this when importing.

Become an admin on a trusted server, import a character from another server, use your admin rights to level it up, reimport it on the original server. Solution: Server admins should choose carefully from which servers they allow character import.

Bertram - 2010/04/09

Export your character, change the experience and attributes and ask for importing it,
or does some cryptographical signature encrypted with the private key of the keypair cares about making a hash about all the data?
The concept is cloudy fine :) But as paranoid admin, I'd say would it be better to had a way
to make two servers do the transaction all by themselves, on the player request, of course?

Crush - 2010/05/03

That's what the cryptographic signature by the exporting server is about -
it is supposed to cover the whole data so that the user can't change anything
without invalidating the signature.
 
Regarding making the transaction from server to server - I dislike this idea
because it would allow servers to blacklist not only import sources but also
export targets. The whole purpose of this interface is to allow players the
choice to switch servers and take their character with them without needing
the consent of the source server (except for general character exporting, of
course).
 
Giving the player a verifyable XML file with its character stats also allows
a lot of other potential applications.

Bertram - 2010/05/05

//The whole purpose of this interface is to allow players the
choice to switch servers and take their character with them without needing
the consent of the source server (except for general character exporting, of
course).//
-> Why avoiding the consent of the source server is a concern for you?
If some servers won't want to give export access, they would disable
the feature anyway or refuse to give the private key for the hashed data,
or make a tool only reserved for admins out of it.
If this point isn't really relevant anymore, I can't see why two servers
couldn't do the transactions all by themselves, on the player request,
of course.
Apart from that point, I'm fine with that rather unique concept. :)