How to perform authentication without central server in P2P?

Question

How can one be sure that the man who you're talking with is the one who you think he is? i.e. How can one perform authentication in P2P network without a central trust server or Certificate Authority?

I'm just wondering how someone can make distributed (peer-to-peer) overlay network or chat using DHT for finding peers (like BitTorrent Chat has done).

BitTorrent chat uses DHT to find some information about peers and then to connect to them directly. I think it uses assymetric cryptography, as well. But this doesn't solve the problem of somebody trying to perform a MiTM attack by putting a lot of incorrect data about peers into the DHT (i.e. incorrect peer IP addresses or public keys).

Answer 1

For P2P authentication, you can go for web of trust concept. Simply this means, if someone is trusted by people you can trust, you can also trust that unknown person. In OpenPGP, a certificate can be signed by other users who trust the association of that public key with the person or entity listed in the certificate. So trust relationships can be propagated.
In addition This presentation discusses about P2P authentication, including authentication methods without central server. It proposes web of trust and few other concepts. Also I found a survey about this topic. You can choose a method according to your requirements. Hope this helps.

Answer 2

You may be interested in something like the Cryptographically Generated Address (CGA) from RFC 3972. CGA is used in Secure Neighbor Discovery Protocol (SEND) of RFC 3971 to bind a public key to an IPv6 address.

The basic idea of CGA is to generate part of the IPv6 address by computing a cryptographic hash over the public key. The corresponding private key can then be used to sign and authenticate messages. The downside of CGA is that it is expensive to generate such an address as the generated hash must meet certain criteria. e.g. the 16 left-most bits of the hash output should all be zeroes

In a P2P network, users can generate their own identifiers in a similar fashion to CGA and publish them publicly. Users are authenticated as long as they are able to prove that they have knowledge the corresponding private key whose public key is binded to their identifiers.

Although anyone can generate an identifier, CGA can protect against spoofing of existing identities. In order to masquerade as an existing user, an attacker will need to do a pre-image attack against the hash function to obtain the public key. This will not be easy especially when the public key is 2048 bits or higher.

Answer 3

Authentication without a central server (as trusted authority, e.g. root of a PKI) is a difficult task. The main question is, what actually defines the identity of a user and which information can be used to verify an identity claim.

One idea would be to use digital signatures, where each user holds his own signing key and can verify himself by signing challenges. However, in order to avoid MitM attacks one-sided authentication is not enough, mutual authentication is required. However, to set up a way that the network can authenticate itself for the user, more information about the network is required.