We were making kind of a simple game, in which:
- Users receive the
next number of play
as anencrypted string
Before they play - After they play, the encryption
password
is provided to them to check the play number was correct. - Each encrypted string is
only valid for 1-2 hours
and number of play , verificating string and encrypted string is regenerated again after that time - The encrypted string includes a verification (5 char) code so both users and we can make sure Decryption process was successful
Sample Character to get Encrypted (QQ9LU
is random verification code provided to user before the play):
Next Play Number: 8 - Verify String: QQ9LU
Sample Encrypted String (provided to user before play):
NXRykKOv3B6kuu4Ke3svp7HH3enNiqIZrJSXJiF54QkHHjtXgqpUXxyuP7YUNICeFLg==
Sample Password (provided after play):
Please note this is generated randomly for each encryption
FA00RDjA77hlOzcOzH6kuGcc29CyM7Hw
We use CodeIgniter 2.2.2 Encryption Class to encrypt/decrypt strings
Encryption Method Info:
- Function Used:
$this->encrypt->encode($msg, $pass);
with random pass each time - Cipher is CodeIgniter 2 default
MCRYPT_RIJNDAEL_256
- Mcrypt mode is
MCRYPT_MODE_CBC
My Questions are:
Can i trust that users cannot break the encrypted string (and know the number of play before they get the password) in 1-2 hours (aside from getting lucky)
Is placing random verification code
Verify String: T3YH4
in there good or bad? does is affect security? (this is to verify decryption result was successful, also we added it because the only variable in each string was a single digit, for example only number 8 changes to 7, so we wanted to add more variable characters to the string to possibly have a better security)
Any other suggestion is appreciated