I am writing a multiplayer game. I have a central server which processes everything. For data exchange I use HTTPS protocol. Because this is a game I cannot use computationally expensive systems like RSA for data transfer.
- Client uses sha512 to produce hexadecimal hash from password and random
- Client sends "login" request with username, hash and
seedto the server.
- Server checks if user has not attempted too many login requests and checks whether the password hash matches the hash made from the password in the database. If it does, it sends an
access_keyand a response that login was successful
To send requests which require login,
- Client sends a hash generated from the
seedalong with the request data.
- Server checks whether the IP has not changed and whether the hash made from
seedis correct. If it is, new
access_keyis generated from the old one, request data is processed and the server returns the new
access_keyalong with the response from the request.
At any time, if client's IP changes or invalid
access_key is sent, the session is automatically terminated.
How secure is this approach? What can I do to improve it?