Battleship game state save so players can't look up each others' states but server can

Question

1. Summarize the problem

I want to encrypt save game data for 2 players game - you can think of it as classic "Battleship" game:

• Player A knows his game state, does not know Player B's game state.
• Player B knows his game state, does not know Player A's game state.

To create a save game, both states are combined to encrypted format. This way, both players can download a save game without looking into it what is an opponent game state.

The server can know both game states and has to decrypt both players' game states to know them.

Inputs to create crypto keys can be:

• players names (known only to player A and B)
• game ID (known only to player A and B)
• players' passwords (each password is known only to the respective player and is always typed into the Frontend - the server does not need to know it)

2. Provide details and any research

I figured out I want to use asymmetric encryption and public key cryptography.

But when looking at my solution, I realized it might seem simple and easy, but I remember rule 1 of crypto: never do it yourself so I seek advice here.

3. When appropriate, describe what you’ve tried

Players type in frontend their name, password & game ID.

If a match found for name A, name B, password A, password B & game ID we have a "decryption key" that successfully is going to decrypt both players' game states for the server.

The problem is I have "too many" inputs (public keys) and too few private keys. I do not know how to mix them up.

A model I found only works on 1 public and private key https://docs.huihoo.com/globus/gt4-tutorial/ch09s03.html - I have times 2 complexity than this. Many different inputs to combine for a 1 key... How do I mix them together I have no idea.

PS I do not know how to describe the problem better to find a surly already existing solution. Can you recommend a primer course focused on multiplayer games?

Answer 1

You don't even need the server to decrypt. You need players to commit to their initial board by providing a hash of the board(probably with extra random data to increase entropy). They can then play as usual. And save the game in encrypted form using independent keys. At the game end commitment are to be revealed to verify no cheating. The server need not do anything beyond store information and optionally forward messages.

Alternatively if you have a trusted server, skip encryption of state entirely, only have both parties authenticate to the server, and communicate with it over a secure channel (e.g HTTPS) and the server will enforce permissions and let each player see only their own state.