Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

How you be sure that the man who you're talking with is the one who you think he is? I.e. how to perform authentication in P2P network without central trust server or Certificate Authority?

I'm just wondering how can someone make distributed (peer-to-peer) overlay network or chat using DHT for finding peers (like BitTorrent Chat have done).

BitTorrent chat uses DHT to find some information about peers and then to connect to them directly. I think it uses assymetric cryptography, as well. But this doesn't solve the problem of somebody trying to perform a MiTM attack by putting a lot of incorrect data about peers into the DHT (i.e. incorrect peer IP addresses or public keys).

share|improve this question
    
Thank you very much for your edits, mikeazo! –  Abzac Dec 20 '13 at 13:50
    
In order to be relatively confident of someone's identity you have to have at least an idea of that identity. Would a pre-distributed ID list (eg. a file with an alias and public key) suit your needs? –  rath Jan 12 at 23:55
add comment

3 Answers

You may be interested in something like the Cryptographically Generated Address (CGA) from RFC 3972. CGA is used in Secure Neighbor Discovery Protocol (SEND) of RFC 3971 to bind a public key to an IPv6 address.

The basic idea of CGA is to generate part of the IPv6 address by computing a cryptographic hash over the public key. The corresponding private key can then be used to sign and authenticate messages. The downside of CGA is that it is expensive to generate such an address as the generated hash must meet certain criteria. e.g. the 16 left-most bits of the hash output should all be zeroes

In a P2P network, users can generate their own identifiers in a similar fashion to CGA and publish them publicly. Users are authenticated as long as they are able to prove that they have knowledge the corresponding private key whose public key is binded to their identifiers.

Although anyone can generate an identifier, CGA can protect against spoofing of existing identities. In order to masquerade as an existing user, an attacker will need to do a pre-image attack against the hash function to obtain the public key. This will not be easy especially when the public key is 2048 bits or higher.

share|improve this answer
    
I don't much familliar with IPv6. Is it true that you can choose any global IPv6 address as you want? As far as I know IPv4 adresses are given by your ISP, however you can choose your address in LAN. –  Abzac Jan 15 at 6:17
    
The 128-bit IPv6 addresses consists of two parts : the leftmost 64 bits are the subnet prefix (most probably assigned to you by your ISP) while the rightmost 64 bits are the interface identifier which can be indirectly chosen/generated by users as documented in RFC 3972. –  jingyang Jan 15 at 7:31
add comment

For P2P authentication, you can go for web of trust concept. Simply this means, if someone is trusted by people you can trust, you can also trust that unknown person. In OpenPGP, a certificate can be signed by other users who trust the association of that public key with the person or entity listed in the certificate. So trust relationships can be propagated.
In addition This presentation discusses about P2P authentication, including authentication methods without central server. It proposes web of trust and few other concepts. Also I found a survey about this topic. You can choose a method according to your requirements. Hope this helps.

share|improve this answer
add comment

Authentication without a central server (as trusted authority, e.g. root of a PKI) is a difficult task. The main question is, what actually defines the identity of a user and which information can be used to verify an identity claim.

One idea would be to use digital signatures, where each user holds his own signing key and can verify himself by signing challenges. However, in order to avoid MitM attacks one-sided authentication is not enough, mutual authentication is required. However, to set up a way that the network can authenticate itself for the user, more information about the network is required.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.