Counter-Strike: Global Offensive Network Channel Encryption

__NOTOC__
This page outlines the basics of how CS:GO network channel encryption works, and how 3rd parties can provide client software and server plugins to ensure that communications between game client and game server use network channel encryption keys. CS:GO update version 1.35.6.0 or above is required to use the 3rd party network channel encryption keys protocol.thumb|right|360px|Counter-Strike: Global Offensive
CS:GO network channel communication can be encrypted with a 16-byte binary key. Initial "connectionless" packets starting with four bytes 0xFF 0xFF 0xFF 0xFF and followed by either A2S_GETCHALLENGE 'q' byte or C2S_CONNECT 'k' byte and are always sent unencrypted in the clear. After the client connection is accepted by the game server, the network channel is established and must be used. If the network channel must use the encryption key then the key configured on the client side and on the server side must match for communication to succeed.
== Exchanging Encryption Keys ==
3rd parties can implement encryption keys management for their players in many different ways, and can control which clients require encryption keys and which clients can connect without an encryption key. If the client requires an encryption key then typically 3rd party backend will have a secure connection with client software to inform the 3rd party client software in a secure way of the required encryption key. Secure implementation of backend to client protocol is required because this channel is the most likely target for man-in-the-middle attack by malicious clients with the goal of extracting the encryption key. 3rd party client software will forward the encryption key to the CS:GO game client using machine-local communication. At the same time 3rd party backend will communicate the client's encryption key to the 3rd party game server that will be hosting the match for this client. By the time the client connects to the game server they can both use the same established encryption key and benefit from encrypted network channel communication.
== Setting Client Encryption Key ==
The following code shows an example of setting the CS:GO game client encryption key from 3rd party client software. The format of the payload is the remote server address for which the client should use the key, the angle symbol '>', the 32-bit key index to use which must contain non-zero in the upper word ( ( idx & 0xFFFF0000 ) != 0 ) to avoid conflicting with built-in encryption keys, the 16-byte plaintext key that the client will use to encrypt messages, and non-zero amount up to 256 bytes of 3rd party defined payload that client will send to the server over the wire unencrypted so shouldn't contain the encryption key because man-in-the-middle attacker will be able to extract it.
== Setting Server Encryption Key ==
A 3rd party server plugin is required to set the game server encryption key, and game server must run with -externalnetworkcryptkey command line parameter to activate the feature. Plugin must implement IServerPluginCallbacks interface v4 "ISERVERPLUGINCALLBACKS004". The v4 interface has been extended with two additional methods compared to v3: BNetworkCryptKeyCheckRequired and BNetworkCryptKeyValidate. Full declaration of C++ interface is included here.
An example implementation of the server plugin is provided here.
== External links ==
* Official site
* Wikipedia:Counter-Strike:_Global_Offensive
Category:Valve Games
Category:Steamworks games
Category:Counter-Strike: Global Offensive