I am developing an online game, where the server is written in Node.js and the client uses Godot. The issue is that Godot has no cryptographic functionalities (it can only encrypt and decrypt files, not elements in memory).
As implementing cryptographic functionality would be out of my capabilities with Godot, I've been thinking of a way to authenticate UDP packets.
I have the following idea: client logs in via HTTPS and gets a refresh token, and a shared (with the server) secret. The refresh token is used to renew the secret every 10 mins.
To authenticate UDP packets (which are sent unencrypted), the packet contents are hashed with the secret included, the packet is sent with the hash. Then the other side verifies that the hash with the secret is valid.
Is this approach secure enough? Considering that the secrets would be randomly generated long strings, would an attacker be able to calculate the secret by analizing several packets? My options for hashing are MD5 and SHA256 which are the algorithms available in Godot.
Being that UDP is only used for game events which don't need extreme security (so no personal information, payment details etc are ever sent in this channel), would this work?