0
\$\begingroup\$

I'm creating a real time multiplayer game. Each piece of data needs to be received, but it still needs to be as fast as possible which is why I don't want to use TLS for every request.

Here's what I was thinking:

The player logs in using TLS, and receives a session ID and symmetric key that the server generates

The server stores the player's ip address and symmetric key in the database for future reference

When they start a match, they receive a match ID, and send data to the server including the match ID, their session ID, and any necessary data using a symmetric encryption algorithm

The server takes their IP, finds the symmetric key from the database, and decrypts the message and authenticates the user based on the session ID

If everything checks out, the server accepts the data.

Is this approach plausible/efficient? would it be better for me to store the each player's symmetric key using their IP, or for me to get rid of the IP/symmetric key link table and send the data with the session id not encrypted, and store the key using the session id?

Any answers/comments would be greatly appreciated.

\$\endgroup\$
2
  • \$\begingroup\$ I am not sure if your argument to re-invent the wheel (especially a cryptographic one!) is strong enough, can you elaborate why exactly existing solution does not fit your needs? If performance is the main concern, have you profiled to confirm the suspicion? \$\endgroup\$
    – wondra
    Commented Jun 20, 2017 at 18:26
  • 2
    \$\begingroup\$ Storing via IP can be bad because of NAT. Multiple players can be seen to have the same IP if they're coming from the same local LAN. \$\endgroup\$
    – House
    Commented Jun 20, 2017 at 18:31

1 Answer 1

Reset to default
0
\$\begingroup\$

You seem to have two misconceptions which will mean that it won't work for a large part of your potential player-base:

  1. You assume IPs are static and never change. That's wrong. Many ISPs reassign customer IP addresses daily.
  2. You assume that everyone has an unique IP. Also wrong. It's quite frequent that multiple users share the same external IP address via NAT.

Two connections coming from the same IP address is evidence that they might be the same person, but it's no proof. So never try to use IP addresses as identifiers for people (or even machines).

Also, the benefit of this scheme is very small. TLS only needs expensive asymmetric encryption during the handshake when the connection is established. After the connection is established, it uses a symmetric key for encryption until the connection is disconnected.

So just use out-of-the-box TLS encryption.

\$\endgroup\$
1
  • \$\begingroup\$ makes sense. I was under the impression that tls was stateless but that's just https \$\endgroup\$
    – Jamal H
    Commented Jun 20, 2017 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .