I'm developing a networked game, and this game will require players to authenticate to the server. The both client and server are written in Java. I'm trying to find an efficient password transmission method.
I remember looking at SRP-6 a few years ago, and reading that it was what Blizzard uses for World of Warcraft, and thought that perhaps it might work.
Then a friend of mine told me that the way he deals with transmission is to ask the login server for its public key, then send the username, password, and the client's public key (where the keypair is generated each time the user opens the client) encrypted to the server. This seems a bit heavy to me in terms of the processor usage and networking required.
Once the user has authenticated, the login server sends the client a unique login token, that can be thought of as a session id. After authentication has completed, the rest of the game packets are unencrypted between the client and the game server.
Another thing to take into consideration is that this game will be released to the public, in a similar manner to Minecraft, where users can download the server, start it, and allow users to connect to it. This bit is was kind of dissuaded me from using SSL/TLS between the client and server, as I don't want to burden the user with certificates.
Is there any reason to prefer the asymmetrical encryption over SRP? Is there something else that's proven to be secure to transfer just username/password data?