3

I chose SSL for registration in the game client. The client communicates with the game server which stores a salted/hashed password.

If I use SSL to authenticate users on login but the game does all of it's communication with UDP packets, how does the server know that the UDP packets it's receiving is from the authenticated user?

Note that I'm mostly interested in ensuring the user is authenticated. I don't care about the privacy of the UDP packets.

7

The safe method is to use DTLS: that's SSL/TLS applied to UDP.

The less safe method is to invent your own protocol. In this case, since you worry about authentication only, things would go that way:

  • Client and server make some normal SSL and run an authentication protocol within that SSL.
  • Client and server exchange a symmetric key K within that tunnel (e.g. client generates K randomly and sends it to server).
  • Each UDP packet sent by the client is authenticated with a MAC (e.g. HMAC) using key K. The server uses K to verify that the packet really comes from the client and has not been altered in transit.
  • Each packet must include a sequence number, and the server must maintain some knowledge of the last received packets (with a window for out-of-order packets), so that the server may notice when packets are dropped, duplicated, reordered, or replayed.

Proper packet management to avoid replay attacks is a matter of subtlety; leaving that job to an already implemented DTLS library is the smart thing to do.

-1

I don't think you have something unclear. To make SSL authenticate, who is the certificate holder, client or the server? It seems client holding the certificate is reasonable. In such case, server must have public key of this certificate. Thus an easy way to approach authentication is to encrypt the sequence number of UDP package and some random string with private key. Thus if server can decrypt the signature in the UDP, it makes sure the package indeed comes from client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.