Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to implement the SRP crypto; 6a. However I'm not familiar with the cryptography and it's computing. I'm using the public implementation of the BouncyCastle lib, but I have no idea how it works actually. It's for a "private" server for a game and I'm kinda stuck now.

share|improve this question
    
Do you need to conform to a pre-existing binary protocol? SRP by itself is just a mathematical protocol. –  CodesInChaos May 3 '12 at 15:22
    
No just plain SRP with a different K compution. –  John May 3 '12 at 15:34
add comment

1 Answer

Implementating your own authentication protocol is not easy and should be left to professionals. If you feel like you have to write your own security protocol, you are doing it wrong. A lot of other people have this same need, and they have already implemented it for you.

SRP isn't a bad choice for authentication, in fact there is SRP-TLS, which uses SRP to create a TLS connection. SRP-TLS has been implemented in OpenSSL and bindings for this library exist for C#.

Also keep in mind, that the password itself isn't how the client maintains its authenticated state. For example, in a web application a user logs in with a username and password and they are given a cookie to authenticate with the web application. If the attacker obtains this cookie, then can login. To prevent this, the entire session (or in your case the entire game) must be protected with TLS, or you will be in violation of OWASP a9 and anyone sniffing the wire can just wander into the game.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.