UDP for games – encryption and DDoS protection
1–10 of 47 posts
Re: UDP for games – encryption and DDoS protection
#2Re: UDP for games – encryption and DDoS protection
#3On the end encryption is useless but it blocks 90% of the curious people that don't have the skills to go further ( ie: reverse engineer the game )
Re: UDP for games – encryption and DDoS protection
#4"encryption is to prevent eavesdropping and session hijacks by the third party [...] it is Really Important for stock exchanges"
Stock (and other financial) exchanges are major users of UDP, but in general they do not encrypt it.
Exchanges give clients direct connections to their networks using dedicated Ethernet lines, one per customer. This, combined with datacenter security, is what prevents eavesdropping and session hijacking. They do not use UDP over the Internet at all.
Re: UDP for games – encryption and DDoS protection
#5>As a side bonus, with proper encryption you can be sure that network errors which corrupt your packets are not going undetected
Shouldn't you be verifying a MAC before decrypting anyways? Relying on decrypting scrambled data, especially for a bitflip, seems like a bad idea.
>Potential attack here is about attacker modifying the (unencrypted/unsigned) data coming to the victim’s Client,
So establish a session key, and include an HMAC on each message? Or not even a session key, if you're worried about re-establishing sessions, but a long-term per-client key (or per-install or whatever). Hardly seems like you need QUIC/DTLS for this simple scenario.
Then all the part about DDoS'ing a UDP connection establishment... Why not just use TCP for sign-in and key establishment, and get 3-way handshake for free. That eliminates spoofing IPs. From there, just have monitors that determine when you're "under attack" and rate limit by IP address, just like any anti-DDoS does. Coming up with all this other stuff seems like an overly complex way.
Re: UDP for games – encryption and DDoS protection
#6This talks about a "proof of work" system to mitigate DDoS. What's the "hello world" of such a system look like? It came up in a CTF recently and I had no idea where to start.
Re: UDP for games – encryption and DDoS protection
#7> Both known-to-me implementations of CurveCP (NaCl and libchlorium) seem to be pretty much abandoned as of beginning of 2016,
libsodium (the continuation of NaCl) is actively maintained.
Re: UDP for games – encryption and DDoS protection
#8[deleted]
Re: UDP for games – encryption and DDoS protection
#9This talks about a "proof of work" system to mitigate DDoS. What's the "hello world" of such a system look like? It came up in a CTF recently and I had no idea where to start.
This is some old code, based off of the hashcash algorithm, that prototypes protecting DNS servers using a proof of work (also UDP). https://github.com/jevinskie/SlothNS/blob/master/pow/pow.c#L...
Re: UDP for games – encryption and DDoS protection
#10This talks about a "proof of work" system to mitigate DDoS. What's the "hello world" of such a system look like? It came up in a CTF recently and I had no idea where to start.
Here's a really simple proof of work system: during connection, the server tells the client some randomly generated bytes and a number of bits, and then the client has to come up with a string whose MD5 hash (or whatever algorithm you want to use) has its first N bits match the first N bits of the bytestring that the server gave.
It's easy for the server to adjust the difficulty of the proof-of-work: it just needs to given a larger bitcount to force the client to match a longer prefix.