Public keys or certificates must be exchanged between Peer 1 (Requesting Peer) and Peer 5 (Trusted Peer). While the protocol header of the P2P packet can and must be read by each peer, the payload part is encrypted with the trusted peer's key and stays encrypted while being routed by middlemen peers.

The privacy of a SSL-through-SSL transmission is moved beneath the application layer, limited to the payload, therefore it is made application independent.

Trusting SSL in a distributed environment

To prevent man-in-the-middle attacks against SSL, the trusted peer's key or certificate itself must be obtained through a channel that ensures authenticity, e.g. it must be downloaded from a secure, certified web site.

If certificates or public keys in a P2P network are not either distributed through out-of-band methods, or at least signed by a trusted CA, the identity of the keyholding peer cannot be trusted. It can then at best be used for traffic encryption against the monitoring efforts of third parties *outside* of the peer-to-peer network.


Prev Next Index