0
\$\begingroup\$

I am currently building a launcher for the front end of my game and I am wondering if I should host the public key on a server and have the launcher pull the data as and when needed, or should I distribute it packaged with the launcher. My thinking is that if I distribute it I will need to update the launcher should I need to change the keys but if I host it then I won't need to I just need to swap the keys on the server. I ask because I am unsure if this would dramatically increase load/traffic on the site should the game become popular.

\$\endgroup\$

1 Answer 1

1
\$\begingroup\$

Always downloaded from the server. If the private key is compromised then you can easily create a new one.

If you're worried about load when the game gets popular, you can monetize your website or sell your game to pay for server upgrade/rent.

\$\endgroup\$
9
  • \$\begingroup\$ And what if the downloaded key is compromised? IMO embedding the key would be more secure, even if that adds more complexity. \$\endgroup\$
    – Mario
    Aug 9, 2014 at 8:43
  • \$\begingroup\$ @Mario It doesn't matter if the public is downloaded and "compromised" that's kind of the point. The public key can only be used to encrypt the data but not decrypt. The private key is used to decrypt the data and is stored in a private directory on the server. Sort of like giving everybody access to padlocks to lock their data while I hold the key to unlock it when it arrives on the server. \$\endgroup\$ Aug 9, 2014 at 11:51
  • \$\begingroup\$ @Boreal Paying for server upgrades is not a problem really as I have a sponsor paying the bill it's just every time I need to ask for more I have to "whore" myself out to my sponsor to secure said upgrades. \$\endgroup\$ Aug 9, 2014 at 11:55
  • 1
    \$\begingroup\$ @Mario, when you use asymmetrical encryption it is safe for the user to know the public key. The public key is used to encrypt a message, which can only be decrypted by whoever has the private key, which need not be shared. The only way the private key can be compromised is to brute-force it, which is infeasible, or to gain access to the server itself. \$\endgroup\$
    – jmegaffin
    Aug 9, 2014 at 12:43
  • 1
    \$\begingroup\$ Also, @Mario encryption is not going to stop cheating. It only prevents passwords and other sensitive information from being obtained by someone intercepting the packets you send to the server. \$\endgroup\$
    – jmegaffin
    Aug 9, 2014 at 12:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .