Is RSA useless when my app is fully decompiled?

Question

I've programmed an Android game with Unity Engine. As you know in Unity, scripts compiled into one file named "Assembly-CSharp.dll". I wrote my scripts in C#.

After I compiled whole game into .apk, I renamed it to .zip and dragged the Assembly-CSharp.dll into tools like ILSpy, while the whole program was fully decompiled with all of the details like my RSA public key or AES password, IV, salt ...
The logic of my app is client (Android) and server (Java).

When player finished a level, with this URL: http://www.example.com:8080/MyApp/SaveScores.do?hash=labla....labla, we give him score. The real parameters are username, score, timestamp. Our encryption algorithm is RSA 1024 bit.

When cheater/attacker sniffs HTTP traffic to use replay attack, we check the decrypted hash with RSA and with timestamp parameter we kick him out.

But when he decompiled code beautifully with tools (ILSpy) he simply find my public key and find out that I encrypt user score and timestamp with that publickey. Then, he will write a Unity or C# programm to simply encrypt his manipulated message with a new timestamp and he will be trusted in my server side app because anything is true.

He will increase his score with posting HTTP requests to server without playing the game. He can simply cheat.

What can I do?

1. I can't use SSL.
2. With obfuscating, only crack time will increase.
3. With giving public key at runtime from server to client, memory checkers or traffic sniffers can simply see public key.

Answer 1

Short answer is: Yes, RSA is useless in this case. If all the game logic happens on client side, you cannot prevent cheating.

If your game is reporting only the final score and nothing else, no encryption can help. The game must know how to submit the score and so the full information will always have to be stored in it. You can only make it harder for the cheater by adding obfuscation and other obstacles.

I would suggest two things:

• Send more than just the final score. Send some information about how the game progressed. (What was the score at certain time, when the user lost life, what decisions he took...) Then verify on the server if it is plausible to achieve such score with such game progress.
• Ban any user who submits either results that are not valid, or that were submitted before. Make sure your game always produces valid results and is random enough to not likely produce the same result twice. You don't even have to let the cheater know he is banned, just hide his score from any public lists.

Answer 2

If your client can send the time, the server could issue certificates for the public key to the client with an expiration time as opposed to hard coding the public key in your app.