Hey I'm writing a game and have the backend written using a sometimes-reliable UDP scheme. I want to verify that inbound packets are actually originating from the player specified in the packets.
My idea (not original by any means) was to have the player register an account once and then, once per "session", login over HTTPS/SSL by sending username+password to a simple web service. The game client would check validity of my site's SSL certificate to disallow impersonation. The username and password are submitted and the response is a generated random "secret session key".
Matchmaking happens blah blah...
Then, when playing a match/game, the game client sends packets using UDP and attaches a HMAC-SHA1 of the packet payload using the secret session key as secret. I don't care if people can see the contents of the packet -- there's nothing secret there -- so symmetric encryption isn't needed.
I don't see how the packets can be spoofed since the secret session key was transmitted to the game client over a secure channel but I don't know what I don't know, you know?
Thanks for any insights.