I have been thinking of a way to authenticate users so as to pick out the users using cracked versions of my game from the people who have actually bought it. I came up with this idea:
The client asks the login-server for his
bl_hash, which is updated every 12 hours. (Does it need to be a smaller time frame? I am using Threefish-512 to update the blocks, the key would be a CSPRNG's output. )
The client then encrypts the
bl_hash with the hash of his password (the
u_hash), this is known as the
The client sends his
l_hash to the gameserver along with his username. This is
The game-server sends the received
packet_login data to the login-server.
The login server decrypts the
l_hash with the
u_hash and replies to the server whether this is the guy who he says he is or not.
The game-server either rejects or accepts the player according to what is received from the login server.
I understand this could be susceptible to a man-in-the-middle attack for the server, but this would probably be impossible to do since the gameservers will likely be inside a data centre. Are there any possible improvement that I can make?
Thank you for your time, and I deeply apologise if this is in the wrong site!