How to check if the sender of a udp packet is authenticated? I think sending an authorization token in each packet is slow. So my second implementation is this: the network part will consist of one server and clients. Using the TCP, the client logs in to the server and receives the secret session key and the ID of the client's account (himself). Then, in every udp request to the server, the client should be able to insert the unencrypted ID at the beginning of the packet and encrypt the rest of the packet (the payload) with the secret key. And the server would already look for the secret key by the client's ID and decrypt the message. It turns out a kind of authentication. If you send id + unencrypted data, then after decrypting, the server will receive incorrect data and therefore will not process the request. But in this method, it takes time to transfer the ID and decrypt/encrypt the data. I also thought about this: first, the client logs in to the server and the server puts its IP in the list of clients. Every minute, let the client must send any packet to the server, otherwise it is removed from the list. But as far as I know, IP can be faked in the udp protocol, so in any case you have to encrypt the message. Is it possible to not encrypt the message at all?
7
-
\$\begingroup\$ What threat model are you trying to defend against? Do you anticipate your players will be targeted by a meddler-in-the-middle attacker who can sniff their packets in transit to steal the unique session ID to use in impersonating them? What would an attacker have to gain from this? \$\endgroup\$– DMGregory ♦May 2, 2022 at 11:05
-
\$\begingroup\$ @DMGregory It makes no difference to me and the clients if their ID is stolen, the most important thing is that the secret key is not stolen. If the ID is stolen and the attacker sends a message with unencrypted data, then after decrypting, the server will receive an invalid data set, which it will reject \$\endgroup\$– olegshmelMay 2, 2022 at 15:38
-
\$\begingroup\$ You're a step ahead of what I'm asking you. Why do you need to encrypt the data in the first place? What threat model are you trying to defend against? Is it your belief that a bad actor on the player's own home network or inside their ISP would try to impersonate them? \$\endgroup\$– DMGregory ♦May 2, 2022 at 19:29
-
\$\begingroup\$ @DMGregory I want to encrypt data to identify the user. After all, in UDP, I cannot know exactly who sent the packet without using additional data in the packet, as I understand it. It would also protect against IP forgery (after all, as I understand it, the IP is sent in the packet itself, according to the UDP protocol, which means it can be faked). How does it even work in games like minecraft, terraria? \$\endgroup\$– olegshmelMay 3, 2022 at 9:16
-
\$\begingroup\$ @olegshmel realistically you can use the sender address. Your players don't know the right sender address to fake each others' packets and most ISPs block packets with faked source addresses anyway. \$\endgroup\$– user253751May 3, 2022 at 9:57
|
Show 2 more comments