UDP and TCP Security

Question

We are working on a game with millions of customers communicating with our servers. These games are mostly cornering. I know that UDP offers some performance advantages over TCP, but I wonder if one protocol has a security advantage over another? I read some sites indicating that TCP will generally be more secure, but I have seen a significant number of attacks that exploit weaknesses in TCP.

Our code is pretty tolerant of untrusted connections and lost / unmanaged data, so I was thinking about UDP. Thanks!

Answer 1

This is a good resource for comparing UDP and TCP: http://www.skullbox.net/tcpudp.php .

Traditionally, most real-time applications use UDP, for example: VOIP. I am not a security expert, but I think that both of them are equally safe / unsafe. It depends on the use of security protocols such as TLS, etc.

TCP has only mechanisms that guarantee packet delivery.

Answer 2

The big security issue with UDP is that you are subject to spoofing and DOS attacks . It is not possible to fake an address over the Internet using TCP, as the handshake will never end. There is no implicit handshake in OTOH with UDP — any session service must be performed by your code (processing overhead).

I know UDP offers some performance advantages over TCP

Only through the local network - partly the reason is to reduce the waiting time for the lack of need for a handshake, but the big difference is that it bypasses the mechanisms for controlling congestion. This is not a problem for data on a local network where packet loss will be very low, but if you want to send data over the Internet, you will have to implement bandwidth throttling, error recovery and congestion control in your application (more processing overhead). Although you can handle some types of packet loss with direct error checking, this will not help with an overloaded router. All of these things that slow down UDP exist for some reason.

If your data flows do not exceed, say, 2 MSS in any direction, followed by confirmation from the far end, then do this, but if you want to quickly move a lot of data, use TCP (or wagon).