6

Is there a standard way to secure peer to peer communication?

I'm currently using HTTP to transfer data from peer to peer, however, securing with TLS/SSL normally requires a certificate authority to authenticate identity, and using a self-signed certificate hard coded into an application means it's extractable which would still allow MiTM.

Would creating a certificate on first-run be appropriate, then have the UI display the certificate's fingerprint so the users can verify identity out of band? Or would it be more appropriate to just encrypt the bodies being sent over HTTP with some other library (because rolling my own would be an exercise in making security holes). If so, what are the patterns and libraries that one would use (ideally cross-platform)?

yincrash
  • 303
  • 3
  • 9
  • Do most platform's SSL suites support DH_anon? Could I force TLS to use those ciphers, and prove identity by passing a 6 digit pin (like Bluetooth or Chromecast uses) over the TLS connection and have the users compare the pin with the sending device out of band? – yincrash Mar 08 '16 at 17:11
  • Maybe you can look at how people exchange their PGP keys or use some kind of free CA that everyone can use. The key question is what establishes the identity of a user in your network? Does the user have to own a domain/email address or simply just the key? – billc.cn Mar 08 '16 at 17:41
  • @yincrash - Even if they do support DH_anon, I don't think that will detect an active MiTM attack. – Neil Smithline Mar 08 '16 at 19:39

2 Answers2

5

Is there a standard way to secure peer to peer communication?

Of course there is. If you want to do highly asymmetric communication (i.e. chat or chat-like communication) OTR (or Axolotl) is the way to go. If you want to do (nearly) real-time communication TLS is the way to go.

Both protocols require long-term static keys. You can display the (hex encoded?) hash to the user and let them verify that personally. Additionally you should store the hashes of the public keys and associate them with the peers at application level to warn the user when the public keys change. Beyond that you can offer your users a Web-Of-Trust approach, where they can verify each other's public key / person binding using digital signatures with their private keys.

OTR natively supports using "just public keys", for TLS you can either use self-signed certificates or raw public keys as per RFC 7250 combined with full TLS client authentication.

Community
  • 1
SEJPM
  • 9,500
  • 5
  • 35
  • 66
1

When securing a peer to peer application you are going to need some sort of encryption this you already understand.

I am uncertain what language you are writing your P2P application in but here would be some of the possibilities:

  1. There are many libraries out there which allow you to make use AES, though this would require that both parties to know the password. this in turn will make it annoying and not very user friendly.
  2. You redirect your app via the tor network making use of their encryption layer.
  3. use an SSL cert - getting a signed cert is cheap and easily obtainable even if its just for the initial exchanging of keys (from step one).

In summary the most efficient way is going to be an SSL cert for the secure transfer of data. any other way IMO adds extra complication and removes usability from your users.

You are going to want the built in AES libs in JAVA (if you are in java) or what ever language a quick google will help you out but I do recommend AES if nothing else will do.

TheHidden
  • 4,265
  • 3
  • 21
  • 40