1

I'm creating a home made MMO server (as a hobby / way to learn something new). I've decided to use a token based authentication for game traffic.

Many people say that you shouldn't use any kind of packets encryption in case of the authorative-type game servers. Every packet should be validated and we should assume that the clients are transparent. I get it.

But what to do with the possibility of network sniffing and the man-in-the-middle attacks? If you use the token based authentication, you have to send the token together with the data. The token can be eavesdropped and the attacker can impersonate as you. Is there a way to prevent this without using the encryption?

  • 4
    Encryption protects against sniffing to keep data secret. Signatures or HMAC against modification. Both can be used together to keep data both secret and also prevent modification. But if the latter is all you need (not clear from your question) then signatures or HMAC is sufficient. – Steffen Ullrich Apr 30 at 12:42
  • "Many people say" - Who says? I imagine many people would say you shouldn't assume encryption will prevent reverse engineering of a game client (because it won't), but that doesn't mean you shouldn't use it for other reasons. – AndrolGenhald Apr 30 at 13:13
  • @AndrolGenhald You're right of course. – Miłosz R. Apr 30 at 13:53
  • @Steffen Ullrich You led me on a good track with HMAC. Using keyed hash with some kind of timestamps for preventing replay attacks would be sufficient in this case. – Miłosz R. Apr 30 at 14:03
0

Following to Steffen Ullrich comment I've decided to use HMAC with timestamps and nonces for additional replay attacks protection. This approach should be enough to protect the data against unwanted modifications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.