In our application, a user selects answers to questions. Their score is based on the time spent answering each question down to a tenth of a second. The server is responsible for calculating and storing the score, but it obviously cannot record the exact time spent itsself due to latency.
Somehow, the mobile app will have to send the server the time it took for them to answer the question according to it's own clock. How do I verify that the value in that API call is not being forged?
I figure that at the very least, we can have a string that is hardcoded into both applications that will encrypt/decrypt the timestamps (is AES good for this?) but this is not 100% secure as someone could manage to get that string through decompilation or whatever.
After that, I reckon we could measure the latency in a test request when we first communicate with the mobile app. Then we can ensure the times being sent are within a reasonable window based on that latency. To me this seems kind of finicky and inaccurate. It would be tough to decide on what the window would be since the values are so small. For example, if it took "5s" to answer a question with ~200ms latency, is the window 6? 7? 10? If the window is too large, forgery would still be worth it. Too small and you might screw over legit users who just had a second of lag or whatever.
Is there any robust solution? Would the encryption/decryption be "safe enough"?