# Bingo: A Semi-Centralized Password Storage System
## 5 System Architecture
### Bingo Proxy
A job is instantiated with three retry attempts, with exponential backoff timing used to space out retries. Each attempt is assigned a timer, with the timer being stopped if the job succeeds. Each job also maintains the state of its required data, and uses retries to attempt to fill gaps in its success requirements. Both distribute and retrieve events contain a unique Job ID which peers include in their responses in order to map acknowledgements to their corresponding job. A Distribution Job stores all acknowledgements received from peers as a unique set. When a peer responds to Bingo Proxy with a distributed event, the Job is sourced by its ID and the peer's ID is stored if it was included in the distribution set. If an attacker attempts to acknowledge a distribute event it did not receive, the Distribution Job will ignore the attacker's response. If the Job does not contain N \(\times\) R acknowledgements when the timer goes off, an exponentially growing amount of time is waited before the next retry begins in order to allow for more peers to join the network. During the next retry, assuming that D peers have acknowledged the job, (N \(\times\) R) \(-\) D new peers are chosen based on whether they have already been sent a distribute message for the Job. As such, each attempt requires less peers than the last to acknowledge the event. Once all N \(\times\) R peers have acknowledged the event, the Job's callback function is called with a success message, indicating the workflow may continue. A Retrieval Job behaves in a similar fashion to a Distribution Job in regard to using exponential backoff between retries. Unlike a Distribution Job, a Retrieval Job broadcasts a retrieve event to all peers in the network during each attempt in an effort to receive as many retrieved shares as possible. A Retrieval Job maintains a unique set of all retrieved shares. Once T unique shares have been saved to the Job, the assigned callback function returns a success message, indicating that the workflow may continue. Note that shares sent by peers which are already contained in the set will not count towards the completion of the Job, since SSS demands that T unique shares be collected in order to reconstruct the original secret. In the case of both Job types, if all attempts expire and a given Job fails to collect enough data to succeed, the Job's assigned callback function will return an error message, indicating that the workflow may not continue and that the user should make another attempt to either register or login. 1. Password Versioning: Bingo cannot be considered a practical medium of distributed secret storage if the shares stored for a given user cannot be replaced, such as during a password change. In order to achieve this goal, Bingo Proxy assigns a numerical version to each password share it distributes among peers. The most recent version count, denoted V, is stored alongside the hashed identifiers for a stored User in Bingo Proxy's database. As such, during the retrieval of a user's shares for reconstruction, V is included within the request body. Since all peers receive the distribution request in a broadcast, each peer may use the value of V to prune any stale data it may store for the user, thus preventing shares of any version \(\{1\ldots V-1\}\) from continuing to be stored or broadcasted. Furthermore, any peer which mistakenly or maliciously retrieves and returns a share older than V will be ignored, and the given share will not be counted towards the completion of a Retrieval Job. Note that the use of a primitive numerical counting system for share versioning is not without its flaws. Without mandatory integrity support, a malicious actor may tamper with the version of a share they store, as well as tamper with the version of an in-flight share either during distribution or retrieval. We leave the improvement of Bingo's share versioning system to future work, and propose the use of unique hashes or encrypted version numbers to improve integrity.