How to make the player unable to change some of the game elements?

Question

I am making a text turn based RPG fighting game in which you create your own spells. You also share them as JSON files with your friends. Sharing is required to win. The game is designed so that it isn't a problem if a spell is copied and shared one billion times

I do not want players to edit the files or the spell creator. The only reason is to not ruin others' experience. I wouldn't mind at all if there were no multi-player elements in the game.

Is there a way to make some game elements unable to be modified ?

My game is interpreted in Lua and has some bash integrated into it for file managing. It is also GNU/Linux only.

Answer 1

You can use cryptography. But doing that in a way that actually prevents people from creating spells requires that you do not ship the private key to users, which implies either an internet server, or pre-signing all the spells.

To get a little more concrete, you can cryptographically sign the spells, which essentially means you append a signature to the file which you can use the public key to authenticate. See https://en.wikipedia.org/wiki/Digital_signature

As mentioned before if the private key is on the user’s machine, then it will be possible to use it to create arbitrary spells that another copy of the game would accept! So if you want the spells to be dynamic, then you need someplace to have the private key where players can’t see it which implies a server.

But, if you don’t want to do that, another option would be to create all the shareable spells ahead of time and to pre-sign them. That way, only those spells will be accepted by unmodified versions of the game. (Someone could still modify their own copy of the game to cheat, whether you use a server or not.)

Given that this is a GNU/Linux only game as you say, I can guess that you may want to open-source it at some point. Understand that if you open-source the private key then all this crypto stuff will be circumventable. You could make a different private-public key pair for an open-source version if you like, without compromising any other key pairs.