Jenkins Software

Secure Connections

Protect your game from hackers

Once your online game reaches a certain popularity people will try to cheat. You will need to account for this both at the game layer and at the network layer. RakNet handles the network layer by providing secure connections if you wish to use them.

RakNet provides data security on par with 256-bit TLS. An efficient 256-bit Elliptic Curve key agreement with forward secrecy protects each connection with the server.
  • Cookies: Uses stateless cookie in the handshake, analogous to SYN cookies, that ensures the remote IP address is not spoofed
  • Efficient: Modern techniques published and improved in the last 2 years are employed to offer security without a performance penalty.
  • Forward secrecy: Uses Tunnel Key Agreement "Tabby" protocol. If the server is compromised at some point in the future, previously exchanged data cannot be decrypted.
  • Protection: Each message is encrypted and stamped with a message authentication code (MAC) and unique identifier to protect sensitive data and prevent replays.
  • Immune to active attacks (man-in-the-middle) if server key is known ahead of time
  • Uses 256-bit Elliptic Curve Cryptography
  • Elliptic Curve: Over finite field Fp, p = 2^n - c, c small
         Shape of curve: a' * x^2 + y^2 = 1 + d' * x^2 * y^2, a' = -1 (square in Fp)
         d' (non square in Fp) -> order of curve = q * cofactor h, order of generator point = q
         Curves satisfy MOV conditions and are not anomalous
         Point operations performed with Extended Twisted Edwards group laws

Secure connections add up to 11 bytes per packet and take time to compute so you may wish to limit usage to release mode.

The relevant header is as follows:

void InitializeSecurity(const char *pubKeyE, const char *pubKeyN, const char *privKeyP, const char *privKeyQ )

pubKeyE and pubKeyN are the private keys corresponding to the well-known variables of the same name. The same holds true with privKeyP and privKeyQ.

To generate the keys, use the following code:

cat::EasyHandshake handshake;
char public_key[cat::EasyHandshake::PUBLIC_KEY_BYTES];
char private_key[cat::EasyHandshake::PRIVATE_KEY_BYTES];
if (!handshake.GenerateServerKey(public_key, private_key))
{
printf("ERROR:Unable to generate server keys for some reason!\n");
return;
}

You will need to generate the keys in advance, and provide the public key to the clients. It is no longer supported to allow the client to connect without knowing the public key in advance, because doing so allows man in the middle attacks and is therefore not secure.

See the sample at Samples\Encryption to see how to save and load keys.

See Also
Index