1

I'm trying to implement the SRP crypto; 6a. However I'm not familiar with the cryptography and it's computing. I'm using the public implementation of the BouncyCastle lib, but I have no idea how it works actually. It's for a "private" server for a game and I'm kinda stuck now.

2
  • Do you need to conform to a pre-existing binary protocol? SRP by itself is just a mathematical protocol. Commented May 3, 2012 at 15:22
  • No just plain SRP with a different K compution.
    – John
    Commented May 3, 2012 at 15:34

1 Answer 1

3

Implementating your own authentication protocol is not easy and should be left to professionals. If you feel like you have to write your own security protocol, you are doing it wrong. A lot of other people have this same need, and they have already implemented it for you.

SRP isn't a bad choice for authentication, in fact there is SRP-TLS, which uses SRP to create a TLS connection. SRP-TLS has been implemented in OpenSSL and bindings for this library exist for C#.

Also keep in mind, that the password itself isn't how the client maintains its authenticated state. For example, in a web application a user logs in with a username and password and they are given a cookie to authenticate with the web application. If the attacker obtains this cookie, then can login. To prevent this, the entire session (or in your case the entire game) must be protected with TLS, or you will be in violation of OWASP a9 and anyone sniffing the wire can just wander into the game.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .