Live data from Hacker News

UDP for games – encryption and DDoS protection

ithare.com

41–47 of 47 posts

Re: UDP for games – encryption and DDoS protection

#41
post #32

Earlier quoted context omitted.

Sorry, my age may be lower than five. I don't understand. You explain that a hash is computed over a string that is the concatenation of a server key, a random number and a client adjusted nonce. you then lost me with the four bytes. I thought that we were talking about a string of chars, not an array of bytes. The nonce is an integer value ? The client then increases the nonce value I guess. But how does the client…

The basic idea is: The client has to create a hash that satisfies a certain condition: Like the first n-digits must be 0, or maybe "the last bytes (when interpreted as a single 32 number) must be larger than x". So the client does this: from itertools import count import hashlib for i in count(): h = hashlib.md5("some-nonce:%d" % i).hexdigest() if h.startswith("000000"): print i break The value "some-nonce" is provid…

Maybe I'm taking your example a bit far, but it seems like you'd have to choose the hashing function carefully, correct?

To use your example, it must be 100% certain that a hash with 6 leading zeros is possible to generate with md5.

Also, I'm assuming you don't want clients spending too long on the problem, so it seems like you'd want to have a prediction of roughly how long it would take to compute the answer. Otherwise one client may get lucky after 10 iterations whist another may take 10 million. Are hashing functions predictable in that manner?

Re: UDP for games – encryption and DDoS protection

#42
post #29
post #12

> ...if some artifact within your game costs $20K+ of real-world dollars – you should start thinking about [encryption] seriously. In these cases, game account becomes as important as (and for quite a few people out there – much more important than) a bank account. Which carries all the security implications of the bank, including (but not limited to) encryption. Sorry to nitpick but UDP seems like the wrong protocol…

TCP and UDP occurring over the same route on a WAN can wreak havoc with UDP packet loss.[1] Using both is only a good idea up until you dig deep into socket performance. A network is not a piece of software where you can isolate things and expect them to behave in an isolated way, everything you push over it interacts with everything else that you are pushing over it. This "use UDP and TCP" is a dangerous anti-patter…

With my example for login, my assumption was that one would use short-lived TCP connections (i.e. server receives login packet, sends success/fail and finally closes the connection), not a simultaneous, persistent connection where TCP congestion (and thus UDP packet loss) becomes an issue. But maybe I'm wrong on this one.

Thanks for sharing by the way, great article (although as an aside, some of those graphs are really hard to read).

Re: UDP for games – encryption and DDoS protection

#43
post #41

Earlier quoted context omitted.

The basic idea is: The client has to create a hash that satisfies a certain condition: Like the first n-digits must be 0, or maybe "the last bytes (when interpreted as a single 32 number) must be larger than x". So the client does this: from itertools import count import hashlib for i in count(): h = hashlib.md5("some-nonce:%d" % i).hexdigest() if h.startswith("000000"): print i break The value "some-nonce" is provid…

Maybe I'm taking your example a bit far, but it seems like you'd have to choose the hashing function carefully, correct? To use your example, it must be 100% certain that a hash with 6 leading zeros is possible to generate with md5. Also, I'm assuming you don't want clients spending too long on the problem, so it seems like you'd want to have a prediction of roughly how long it would take to compute the answer. Other…

Reliable hash functions must be able to map to all combinations of 256, 512, or however many bits they are using.

Re: UDP for games – encryption and DDoS protection

#44
post #15

Earlier quoted context omitted.

I took it to mean that you might use UDP for doing stuff in game that might result in losing items. Like, I dunno, maybe an attacker on campus or on WiFi proxies your connection then makes you lose or drop expensive items. I'm not sure how realistic a threat this is. Most likely crypto just helps obfuscate the game to make cheating/RE a bit harder.

When I used to play games like this the popular technique was to dos your connection, then just kill you and take your stuff while you're trying to reconnect.

This was pretty common in the early days of Ultima Online, since your character persisted for about three minutes after you logged out (unless you were in your house or an inn).

Re: UDP for games – encryption and DDoS protection

#45
post #42
post #29

Earlier quoted context omitted.

TCP and UDP occurring over the same route on a WAN can wreak havoc with UDP packet loss.[1] Using both is only a good idea up until you dig deep into socket performance. A network is not a piece of software where you can isolate things and expect them to behave in an isolated way, everything you push over it interacts with everything else that you are pushing over it. This "use UDP and TCP" is a dangerous anti-patter…

With my example for login, my assumption was that one would use short-lived TCP connections (i.e. server receives login packet, sends success/fail and finally closes the connection), not a simultaneous, persistent connection where TCP congestion (and thus UDP packet loss) becomes an issue. But maybe I'm wrong on this one. Thanks for sharing by the way, great article (although as an aside, some of those graphs are rea…

> some of those graphs are really hard to read

I have to admit that I had to squint a bit while reading it myself.

Re: UDP for games – encryption and DDoS protection

#46
post #37
post #18

Earlier quoted context omitted.

How is the client expected to proceed ? Should it try a,b, ... aa, ab, ... ? Couldn't a rainbow table allow to cheat with such algorithm ? It seam that the computation of a MAC or an encryption where the key serves as salt could prevent such cheating. But this computations are now hardcoded in the cpu which won't be the same proof of work for everybody.

Its not possible to maintain a rainbow table because the server would specify the string to start with. Server sends "randomstringthatalsoreferencescurrenttime" Client needs to add strings to this such that the MD5 hash of the result has the first N bits as 0 where N specifies the difficulty. The client is expected to send what it added to the server's string and the server verifies the proof of work.

Oh, I left that out of my description. Having the server specify the salt or the text required to be at the front of the value to be hashed does make things better.

Re: UDP for games – encryption and DDoS protection

#47
post #32

Earlier quoted context omitted.

Sorry, my age may be lower than five. I don't understand. You explain that a hash is computed over a string that is the concatenation of a server key, a random number and a client adjusted nonce. you then lost me with the four bytes. I thought that we were talking about a string of chars, not an array of bytes. The nonce is an integer value ? The client then increases the nonce value I guess. But how does the client…

The basic idea is: The client has to create a hash that satisfies a certain condition: Like the first n-digits must be 0, or maybe "the last bytes (when interpreted as a single 32 number) must be larger than x". So the client does this: from itertools import count import hashlib for i in count(): h = hashlib.md5("some-nonce:%d" % i).hexdigest() if h.startswith("000000"): print i break The value "some-nonce" is provid…

Thank you very much. That was very clear. In the mean time I searched around on google.

The property of this proof of work is that the duration of the work is random.

How is it possible to know the average work time duration, without doing the measurement ? Is it possible to provide a work time limit so that if a client has really bad luck and can't find the solution in that period can he can issue another question ?

From the ur perspective, this varying work time duration may be an unpleasant experience.

Post reply on HN