[p2prg] P2P security

[Ivan Shmakov <[e-mail]>]

>>>>> Pedro Martínez Juliá <[e-mail]> writes:
>>>>> 15/07/12 16:07, b7uR:

[…]

 >> * lack of security

 >> * no computer in the network is reliable

 >> Therefore, peer-to-peer networks are only useful for a small number
 >> of computers (generally about 10), and only suitable for
 >> applications that do not require a high level of security (it is not
 >> advisable in a business network containing sensitive data).

	For a counter-example, Bitcoin is an “alternative currency”,
	which is backed by a P2P network, and is considered secure
	against forgery (IIRC, [1].)  By its very design, it's not
	secure against eavesdropping.

[1] http://www.slideshare.net/dakami/bitcoin-8776098

[…]

 > About security, reliability, and trust, your claims are totally
 > wrong.  You can build a security scheme for P2P networks and also a
 > reliable network by carefully selecting the nodes you use to build
 > the overlay network from the available nodes in the P2P network.

 > That said, you can control which nodes form part of the overlay
 > network, so they will not destroy your communication (see Kademlia).
 > Also, you can use any hashing and signing mechanism to ensure that
 > the information you receive is not modified on its way, the same as
 > the underlying networks.

	The data being distributed via a P2P network may be encrypted
	just as well (making eavesdropping ineffective), which is the
	basis of operation of the GNUnet, Freenet, and Tor P2P networks
	(AIUI.)

	Also, the Metalink [2] format, which allows for a single file to
	be downloaded from multiple sources at the same time, including
	P2P filesharing networks, is based on XML, and thus can be used
	along with XMLdsig [3] digital signatures to thwart forgery.

	The magnet: links may, and the .torrent files have to, contain
	cryptohashes, so, if received from a trusted source (like, for
	instance, a trusted HTTPS server), provide for a forgery-proof
	way to obtain data from a P2P network.

[…]

[2] http://tools.ietf.org/html/rfc5854
[3] http://www.w3.org/TR/xmldsig-core/

-- 
FSF associate member #7257	http://sf-day.org/