Transmission of messages

Question

I am currently developing a game which will be run in a client, they will sign up for this game online and create their account there, their information will be stored into a MySQL database. I am creating the game using Lua + Love2D, upon launch of the game the user will be presented with a login and password field. The process will go as follows:

1. User submits their data
2. Client sends their username to the server requesting their password salt
3. Client receives salt from server and appends it to their input
4. Client hashes appended password a certain amount of times using SHA256
5. Client sends final hash to server
6. Server checks it's the correct hash
7. Client receives 'true' or 'false' depending if it's the correct password

Now my question is, I hear that someone can easily intercept this data, and get their username, salt, and password hash, then basically send this information to the server somehow getting them authentication to that persons accounts. How can I prevent this from happening? Can I use something like an authentication key? If so, can you explain how that would work?

Answer 1

Yes you are right, someone could intercept the communications and log in as the user, also you are doing a lot of extra unnecessary work on the client. Here is the steps I would do

1. User submits their data
2. Client establishes a secure link to the server (SSL or similar)
3. Client sends their username and password over the secure link to the server.
4. The server looks up the username in the database and retrieves the salt, the iteration count, and the hashed password
5. The server runs the sent password, the looked up salt, and the looked up iteration count through a proper password derivation function like bcrypt or pbkdf2
6. The server compares the output of the previous function to the hashed password it looked up
   1. (optional) If the password was correct, the server checks to see if you have raised the minimum iteration count for the server, if the user's account is below the minimum the server will run the password through again at the new iteration count level with a new salt and record the new hash, the new count, and the new salt in the database.
7. Client receives 'true' or 'false' over the secure link depending if it's the correct password