Is base64 the best two-way hash function to encrypt and transmit a set of integer numbers via the internet?

Question

I am writing a mobile game and I need to save my game data on my game server, so crackers can not find and access the saved files(data) on their mobile. The game data can be expressed by numbers, so it does not really matters if I use Base64 as a means to securely pass the data via a network and/or to prevent data corruption while sending the data via wire.

I need a hash function to prevent the deciphering the game data. So I digged a little and found some, but I am not sure if I can and/or should use them.

1. MD5 – Can I use MD5 as a two-way function? If I can break the data in 64 bit portions, will I be able to recover the original message without a pre-calculated lookup table?

2. Base64 – that can be easily used in both ways which is good cause it is easy, but this is also easy for hackers and crackers.

I don’t know how SHA and other kind of checksums and integrity checks work, or if they are aproperiate for this kind of data (numbers).

Answer 1

1. MD5 – Can I use MD5 as a two-way function? If I can break the data in 64 bit portions, will I be able to recover the original message without a pre-calculated lookup table?

MD5 is a hash function, not a cipher. Differently stated: you will not be able to encrypt or decrypt anything by simply using a hash function.

You could compare MD5 hashes with each other, but that would need you to “pre-calculate” hashes to which you would then compare those other hashes. But hashes will prevent you from learning about the original message (hashes are made to prevent that – among other things). Same goes for recovering the originally hashed data: you can’t. The reason is simple… a hash is not a compression tool which enables you to decompress contained data later on. There’s simply not enough information contained in a hash to do that (if recovering the original file from a hash were possible, everyone would be sharing short MD5 messages and things like torrents would have never been invented).

So – No, you can not use MD5 to recover the original message.

2. Base64 – that can be easily used in both ways which is good cause it is easy, but this is also easy for hackers and crackers.

Base64 is nothing but a simple encoding method. A way to represent data. It has nothing to do with cryptography in the sense that it would be able to provide any kind of security. It is neither a hash, nor a cipher. All Base64 does is that it enables you to represent and transmit (mostly binary) data in a human-readable way. For example: Base64 comes handy when I would want to send you a binary file like an executable via email, but can not (or don’t want to) use the option to attach that file. With Base64, I could simply copy-and-paste the data as a message… which you would then need to convert back to binary data after receiving it.

Long story short – You can not (and should not) expect Base64 to provide any kind of security.

I don’t know how SHA and other kind of checksums and integrity checks work, or if they are aproperiate for this kind of data (numbers).

SHA is also a hash, just like MD5. Hash functions are fundamentally different from checksums like CRC32. Checksums are mainly build and used to verify the integrity of data (for example: during data-transmission, or after data storage), while cryptographic hash functions also target things that go well beyond data integrity checks. You could use a hash to provide what a checksum does, but a checksum can not provide all the things a hash can provide… things like “collision resistance” for example. In that sense, you could say hashes are “smarter” (but also slower to calculate).

To give you a hint related to all of your questions: What you are actually looking for is called a ”cipher”… an ”encryption algorithm”.

---

Some humble advice

Now, please don’t get me wrong… but you should really start from scratch with your research, since you are obviously getting most of the things you have been digging up absolutely wrong and trying to implement cryptography in your software with your current knowledge level is bound to fail.

To help you understand the fundamental things you are currently mixing up, I would humbly advise you to start reading the following two:

• https://en.wikipedia.org/wiki/Encryption
• https://en.wikipedia.org/wiki/Cryptographic_hash_function

After reading (and understanding) those Wikipedia articles, slowly work your way up to the point where you can be confident that you know what you are doing and talking about.

On your way, things like the Handbook of Applied Cryptography (available for free as online version) will definitely come handy as it is easy to read once you grasped some minimal basics of crypto.

As said, please don’t get me wrong and please don’t take my advice as some kind of personal offense. I just do not want to see you fail securing your software or maybe even messing up the security of your game server, just because no one pointed you to the fact that you are currently simply too misinformed to even think about implementing cryptography in your game all by yourself.

On the positive side: you were smart enough to ask before doing something wrong, which is good. Therefore, I am confident that – with a bit time and effort – you’ll quickly reach a point where you’ll look back on this question and smile. Yet, think in weeks… not days or hours. Crypto can’t be learned in a day. In contrast, cryptography can be so tricky to implement that even experts sometimes fail to do it correctly because they missed a tiny detail somewhere. Gaining a somewhat useable level of knowledge so that you can implement it in your game and server surely won’t happen by tomorrow.

EDIT

Adding part of the comments that followed up this answer:

• OP:
  … May you please advise me on finding an easy encrypt/decrypt with acceptable level of security? I prefer the method is common enough so I can use built in libraries while implementing both on server and client sides
• ME:
  Depends on the coding languages you’re using, but AES is available on about every platform and there are many libraries (eg: OpenSSL) out there supporting it. So, that could be an option… especially because you probably have the best chances finding "HowTo" tutorials related to it. Besides that, you’ll have to consider thinks like "keys" and “key exchange” (for authentication and encryption) but all that is too broad to wrap it up in a single answer or comment. If I were you, I would take things step-by-step and when in doubt – ask here or (if it’s source-related) at StackOverflow.
• OP:
  … I am a bit familiar with keys and two way keys concept and I think I can use AES by reading some tutorials …

That should wrap it up completely.

Answer 2

It is very likely you do not need encryption or hashing to get the security you need. It is depressingly common for people to spend a lot of effort and complexity in security measures which don't actually add security. The first thing you need to do is define the threat model and the legitimate modes. You have a mobile game with a client and server. Presumably the server is under your control and considered trusted. The client is less trusted and you wish to put some limitations on what it can and can not do. You also may want to protect against third parties (he trivial solution for that is normally ssl). If you save game state on the server and validate all user input and have logic checks for all state changing operations you gain a lot of security wih no need to encrypt anything. You can get an off the self authentication solution without dealing with ceypto yourself and an off the self transport security (SSL/TLS) and focus your security on the logical layer. If you for some reason need to make the server stateless but still let it validate all state and possibly even authenticate users you need something more interesting and may need to think about the cryptography involved. Most games don't need this. Note with any encryption system the hard part is almost always key management. Encrypting on the client with the key on the client is not really encryption, it's an obfuscation technique and doesn't provide much security against most threat models.