1
\$\begingroup\$

I have a multiplayer game with a custom client app and an application server (no browser or website). I need

  1. the data that passes between them to be encrypted both for the login data obviously and for the game actions.
  2. that the server answer only to requests from my clients and that the clients get information only from the server.

From what I read, I need 2 certificates for that. Can I use self-signed certificates for the client and server? How do other games usually handle this?

\$\endgroup\$
8
  • \$\begingroup\$ If you think that adding encryption will prevent people from creating a clone which will communicate with your server, then I have to disappoint you. Any form of encryption requires that your client contains a cryptographic key. A determined attacker can find and copy it. \$\endgroup\$
    – Philipp
    Nov 11, 2018 at 22:15
  • \$\begingroup\$ @Philipp No I don't think it will prevent hacking but i think it could deter. Software puts all sorts of defenses but they still get hacked, doesn't mean they shouldn't do it. Also I think it will help protect the clients from false information from fake servers, no? And I still need to encrypt login and later on purchase info anyway... \$\endgroup\$
    – Mark
    Nov 11, 2018 at 23:34
  • 1
    \$\begingroup\$ Self signing an SSL certificate will not do, no, as it will not do anything to stop man in the middle attacks, i.e. defeating your second point. Getting a SSL/TLS certificate is free of charge these days anyway, so no excuses. But yeah, whatever application level protocol you're using, doing it over SSL/TLS will almost certainly be the way to go (so HTTPS or DTLS), and fulfills both of your requirements (Not to say this is the only way, there are many) \$\endgroup\$
    – ZombieTfk
    Nov 13, 2018 at 1:04
  • \$\begingroup\$ @SamJudge Thank you! i didn't know that SSL cert is vulnerable this way and that you can get ones free. That's very helpful. I'm interested in the other ways to fulfil the requirements (I asked how other games do it). Can you write an answer? \$\endgroup\$
    – Mark
    Nov 13, 2018 at 10:49
  • \$\begingroup\$ @SamJudge Looking at let'sEncrypt that you linked, I don't see how to create the client certificate, only the server one. \$\endgroup\$
    – Mark
    Nov 13, 2018 at 11:44

0

You must log in to answer this question.

Browse other questions tagged .