Take the 2-minute tour ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.

Hey I'm writing a game and have the backend written using a sometimes-reliable UDP scheme. I want to verify that inbound packets are actually originating from the player specified in the packets.

My idea (not original by any means) was to have the player register an account once and then, once per "session", login over HTTPS/SSL by sending username+password to a simple web service. The game client would check validity of my site's SSL certificate to disallow impersonation. The username and password are submitted and the response is a generated random "secret session key".

Matchmaking happens blah blah...

Then, when playing a match/game, the game client sends packets using UDP and attaches a HMAC-SHA1 of the packet payload using the secret session key as secret. I don't care if people can see the contents of the packet -- there's nothing secret there -- so symmetric encryption isn't needed.

I don't see how the packets can be spoofed since the secret session key was transmitted to the game client over a secure channel but I don't know what I don't know, you know?

Thanks for any insights.

share|improve this question

closed as off topic by Maik Semder, Byte56, Patrick Hughes, Nate, msell May 30 '13 at 5:09

Questions on Game Development Stack Exchange are expected to relate to game development within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.

You must have a very famous game, if not, you are wasting your time. In any case, this is more of a general network programming question, voting to close and move it to SE. –  Maik Semder May 29 '13 at 19:07
Lookup DTLS. Its like TLS (the new name for SSL, what https uses) for UDP. There are OpenSSL, GnuTLS and NSS implementations (OpenSSL has an advertising clause, GnuTLS is LGPL so you would need to ship dll/so, NSS only does 1.0 and its beta). There is also SRTP, I'm not sure if RTP is piratical for games, it does include some rate flow stuff you might have to implement yourself (another possibility would be SCTP which can be layered over UDP, but no encryption). Also look at 'perfect forward secrecy' (not sure if it works with any of these standards) and using elliptic curve crypto. –  David C. Bishop Sep 20 '13 at 0:33

1 Answer 1

If you need to use UDP over TCP for performance reasons then per-packet authentication seems counter productive. I would recommend using 2 stacks - UDP for high performance communication such as location updates - and TCP for secure communications or communications that must not fail sporadically due to dropped packets.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.