search

maidsafe-archive / crust

Reliable p2p network connections in Rust with NAT traversal. One of the most needed libraries for any server-less / decentralised projects
BSD 3-Clause "New" or "Revised" License
957 stars 127 forks source link

Encrypt connections #211

Closed kryptan closed 8 years ago

kryptan commented 9 years ago

Is it a planned feature? From readme it seems so but it is not in a "Future work" checklist.

Key distribution I think should be as follows: wherever there is a peer address (either in bootstap file or received from other peer) it should always be accompanied by a public key of this peer. This would allow to encrypt all communications without ever transmitting any single unecnrypted byte. This wouldn't work for local peer discovery though I guess.

vinipsmaker commented 9 years ago

Hi @kryptan, you can have a more detailed explanation of what role each library performs at the safe wiki.

dirvine commented 9 years ago

Absolutely it is planned. There is a consideration and this is it.

  1. Diffie hellman etc. is easy, but it MiTM attackable in many ways.
  2. We have a mechanism where we can get appropriate public keys from a decentralised DHT which is MiTM resistant.

So not everyone will use a secured DHT or secured trustless PKI network for node identification. So we will provide a mechanism where keys will be auto generated and using a IKE mechanism pass these to each other, however there will be an override that allows a key to be passed in a connection request to require no IKE is attempted.

At the moment we confirm signatures in upper layers in this way, but wish to encrypt hop to hop connections using a passed down or IKE key.

As soon as utp is integrated that is a priority (utp plus UDP hole punch with socket handover (SOCKET_REUSE option).

I will mark this as requiring docs also as this should be clear in README and it currently is not.

ustulation commented 8 years ago

This crate had a major re-write/re-design. Please raise an issue again if required as almost everything in the library and the way it handled things have changed. Closing this.