1
$\begingroup$

I'd like to ask you to review security of the following communication scheme:

  • network is strictly P2P, based on DHT (peer discovery)
  • root user can create a virtual private network (network private and public keys)
  • peers belong to private networks
  • if peer wants to join the virtual network, they need to pass their public key to the root, to sign it with the network key
  • peers uses DHT to find other nodes (peers) and establishes direct communication using UTP. The communication is encrypted with a common secret key, decided by both sides (Diffie Hellman).
  • both sides can verify if the other peer's public key is signed with the network certificate.

Questions:

  • how can I implement certificate revocation? I considered passing announcements between peers
  • is there a way to detect that an attacker stole a private key? I thought about a fingerprint based on MAC/computer name/etc.

The best option for me would be eliminating the root user at all and let the group decide if invite/revoke another peer or not.

I know that the signal implements private groups, but in this model you don't have all peers available for 100% time, so you can't decide together on the new key once somebody joins/leave - hence certificates.

Thank you in advance for any ideas, complaints, hints.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.