Encrypting data before transfering?

#1 You would need to get a hash of the password and send the hash across the network from the client to the server.

This resource: www.garagegames.com/index.php?sec=mg&mod=resource&page=view&qid=4085 includes an example of that by adding a stringCRC function that is compatible with the one used with PHP.

With that method accounts could be created via an SSL webpage, and from then on all logins would only pass the CRC value of the password to the server.

You could also add any other hash method you wished to the source, MD5, SHA, etc.

For further security your login process could be a multi-step process where the client contacts the server to request authentication protocol specifications. This could be a bit flags that would tell the client what hash method to use, if a seed text should be added to the password, and if that seed text should be pre- or post- appended to the password.

This would give you a constantly shifting authentication system, for even more fun you could add in a flag to designate different orders that the bit flags would appear in.

#2 Ouch Harold, ain't that VERY advanced? I know a bit MD5, but the rest is pure greek to me.

I'll check the resource out, it sounds like it could bring up some ideas and help! Thanks alot

Edit: I just realised that the resource was only for HTTPObject. I'm using MySQL with Torque directly, but the client never has any connection with the MySQL server.

#3

Quote:
and from then on all logins would only pass the CRC value of the password to the server

The problem with this scheme is the sniffer can sniff the hashed password off the network and then just send that over using a hacked client to log in as the real user. The server would have no idea he was just parroting the CRC and not generating it him/herself from a valid password.

For most games, though, I'd say don't worry too much about it. Unless you're storing accessible financial information of your players through this system, they won't expect it to be *super* secure.

#4 I have a resource that has yet to be posted, it addes an ecipher/decipher to the console class so that one can ecncrypt/decrypt any string.

I did a quick proof of concept with Davis of MRT and it worked fairly well, although my backed was a IIS server using a .net C# web application to validate the password against a MS SQL table.

Once I get off my lazy can I'll post the code as a resource, very basic stuff

I originaly was using libtom, but instead went with something else. Needs a major second set of eyes to ensure its security etc...


-Ron

#5 You need some kind of a challenge response system. The server sends a bit of data over the line that's used in the hash computation. Prevents simple replay exploits. There are various key exchange and authentication protocols that you can look up. My advice is to pick one and follow it rigidly - it's really easy to make encryption useless because of minor implementation quirks.

Straight encryption or password hashing doesn't help all that much. Of course, _anything_ is better than sending passwords over the wire in clear text.

#6 Of course, anything can be hacked. But something is better than nothing, just like you said Mark. :)

Thanks Harold, George, Ron and Mark for the insight.