Hi,
I am trying to use MD5 encryption between my app and the server. To verify what was sent. I don’t really understand how this works. I know that MD5 creates a checksum that I need to send to my server, but how does the server check that aswell? I got the idea from this:
"As-is, the ‘secret’ really doesn’t help at all. Anyone that wants to submit a fake score can simply copy the URL passed, change the score, and re-submit the URL.
A quick work-around to prevent this type of attack is to hash the ‘secret’ along with the data being passed. Then you just send the hashed value rather than the actual ‘secret’. On the server side, you compute the same MD5 hash to make sure the data is legit.
What your link is suggesting is that both your app and the server know a password that an attacker wouldn’t know. Then construct a message to encrypt by using that password along with the score. Now encrypt that message and send the encrypted message along with the score:
require "crypto"
local password = "thisisverysecure"
local name = "joe"
local score = 123456
local msg = crypto.digest(crypto.md5, password..name..score)
local url = "http://www.myserver.com/put\_score.php?hash="..msg.."&name="..name.."&score="..score
When the server receives the encrypted message and the score, it’ll do the same thing to construct a message using the password along with the score and check that the encrypted message it generates matches the encrypted message the app sent. If they are the same then all is good; if they are different then a cheater had changed the score sent to the server. [import]uid: 12108 topic_id: 5465 reply_id: 18388[/import]
I think I get it you are just encrypting and matching on the server to make sure it’s the same data, you don’t actually decrypt the data in that you encrypted, you just match it on the server side. If it matches all is ok.
Am I correct? [import]uid: 8192 topic_id: 5465 reply_id: 18393[/import]
yeah that’s the idea. I don’t think it is possible to decrypt MD5 hashes (but again, I’m not an encryption expert.) [import]uid: 12108 topic_id: 5465 reply_id: 18600[/import]
md5 is a hashing function, not an encryption function. There’s not way to “decrypt” md5 (look up rainbow tables).
https will only help transport security (ie some one sniffing your traffic).
The implementation that jhocking did is probably what I would do here, though i would use crypto.hmac(crypto.sha256, password, name…score). If you’re paranoid I would store the key in a weird format and convert it on the fly to something else. [import]uid: 3 topic_id: 5465 reply_id: 18665[/import]