Do peer to peer networks like Gnutella, Bittorrent have any encryption system to secure the users privacy or encrypt the file/data being shared? Elaborate please.


BitTorrent, when encryption is used (optional in most clients), uses the Diffie-Hellman protocol for key exchange and RC4 for confidentiality. It also drops the first 1kb of data from the RC4 output as part of the specification.

There is no authentication, not really enforceable anyway due to the nature of peer-to-peer sharing networks. Standard theory applies; man in the middle is possible, but a passive attacker, only able to observe traffic, cannot see the content of the messages being sent.

The idea is to stop people from figuring out specifically what data is being sent, but bandwidth analysis will clearly reveal the use of peer-to-peer technology. Other factors, such as popularity (peer count) and total bandwidth may help in identifying the specific files being downloaded.

| improve this answer | |
  • 1
    $\begingroup$ "You should note that the major design goal was payload and protocol obfuscation, not peer authentication and data integrity verification." - I would mention this in the answer: it appears that crypto is used more for obfuscation as opposed to protecting confidentiality. I wouldn't want to use that program thinking data confidentiality was protected if it isn't. (Edit): You basically did, but I think it would be helpful if it was more explicit that confidentiality/authentication/integrity are not maintained. $\endgroup$ – Ella Rose Jun 15 '16 at 15:20
  • $\begingroup$ I don't understand the sentence "authentication, not really enforceable anyway due to the nature of peer-to-peer sharing". Public keys can be distributed in advance by using e.g. a DHT. Networks such as GNUNet and I2P are examples. $\endgroup$ – Aleph Jun 16 '16 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.