[p2p-hackers] P2P Authentication

[Matthew Kaufman]

Frank Moore:
>
> Is there a standard (or any) way of authenticating peers in 
> p2p networks that doesn't require secret shared keys?
> 

I think what you're asking here is "is it possible to design a p2p network
such that the peers must be running the official code that does the right
thing, instead of running some subverted code that does something 'wrong'?"

The answer is essentially no, with one exception, though you can make it
hard... Typical solutions to this problem are "a secret key (or keys)
compiled in to the peer" and/or "hashing part of the executable code on
demand" (which is just using the code itself as the key), but the problem is
that if someone reverse-engineers (or you publish) the protocol or
reverse-engineers (or you publish source to) the software, something that
emulates any challenge-response can be built... At the extreme, they can run
your software in the background, feeding it the challenges and using it to
generate the responses for their client, or simply figure out what is being
used as the data that is mixed with the challenge to produce the response.
Using the code itself has the advantage that someone trying to "cheat" has
to either drag along a copy of your code (and copyright law would apply in
that case) or convince the user to install your good code as well.

The one exception is that you *can* in some cases design the network such
that peers that don't behave "properly" are shunned or dropped by the rest
of the network, assuming that such behavior is detectable. For instance, in
a distributed file store, you could store test data and see if it sticks
around... If it doesn't, that peer is "cheating".

The followup discussion about public key infrastructure, while interesting,
is generally not relevant to your problem... In order to authenticate
itself, the client would need to have a private key, and that's exactly the
same problem as protecting a secret symmetric key from reverse engineering.

Matthew Kaufman
matthew at matthew.at
www.amicima.com