1

I'm creating a home made MMO server (as a hobby / way to learn something new). I've decided to use a token based authentication for game traffic.

Many people say that you shouldn't use any kind of packets encryption in case of the authorative-type game servers. Every packet should be validated and we should assume that the clients are transparent. I get it.

But what to do with the possibility of network sniffing and the man-in-the-middle attacks? If you use the token based authentication, you have to send the token together with the data. The token can be eavesdropped and the attacker can impersonate as you. Is there a way to prevent this without using the encryption?

Improve this question
4
  • 4
    Encryption protects against sniffing to keep data secret. Signatures or HMAC against modification. Both can be used together to keep data both secret and also prevent modification. But if the latter is all you need (not clear from your question) then signatures or HMAC is sufficient.
    – Steffen Ullrich
    Apr 30, 2019 at 12:42
  • "Many people say" - Who says? I imagine many people would say you shouldn't assume encryption will prevent reverse engineering of a game client (because it won't), but that doesn't mean you shouldn't use it for other reasons.
    – AndrolGenhald
    Apr 30, 2019 at 13:13
  • @AndrolGenhald You're right of course.
    – Miłosz
    Apr 30, 2019 at 13:53
  • @Steffen Ullrich You led me on a good track with HMAC. Using keyed hash with some kind of timestamps for preventing replay attacks would be sufficient in this case.
    – Miłosz
    Apr 30, 2019 at 14:03

1 Answer 1

Reset to default
0

Following to Steffen Ullrich comment I've decided to use HMAC with timestamps and nonces for additional replay attacks protection. This approach should be enough to protect the data against unwanted modifications.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .