I am building a Web API for a simple game. The API is SSL-only and uses limited-time tokens for user authentication. I would like to encrypt the contents of a specific request to prevent cheating.
I understand that to do that I will need to make available some encryption keys to the client application (to which the user has full access), so the solution will not be 100% secure against reverse engineering.
Still, I feel that something is better than nothing and am wondering what the best approach would be.
I have come up with a couple of alternatives:
- Hardcode a shared secret in the application source code.
- Use the user's current session token in combination with some obfuscation algorithm and use the result as the encryption key.
I don't particularly like either of these so I wanted to check if there is a better way. Any ideas?