Considerations regarding a p2p social network

Question

While the are many social networks in the wild, most rely on data stored on a central site owned by a third party.

I'd like to build a solution, where data remains local on member's systems. Think of the project as an address book, which automagically updates contact's data as soon a a contact changes its coordinates. This base idea might get extended later on...

Updates will be transferred using public/private key cryptography using a central host. The sole role of the host is to be a store and forward intermediate. Private keys remain private on each member's system.

If two client are both online and a p2p connection could be established, the clients could transfer data telegrams without the central host.

Thus, sender and receiver will be the only parties which are able create authentic messages.

Questions:

• Do exist certain protocols which I should adopt?
• Are there any security concerns I should keep in mind?
• Do exist certain services which should be integrated or used somehow?

More technically:

• Use e.g. Amazon or Google provided services?
• Or better use a raw web-server? If yes: Why?
• Which algorithm and key length should be used?

UPDATE-1

I googled my own question title and found this academic project developed 2008/09: http://www.lifesocial.org/.

Answer 1

The solution you are describing sounds remarkably like email, with encrypted messages as the payload, and an application rather than a human being creating the messages.

It doesn't really sound like "p2p" - in most P2P protocols, the only requirement for central servers is discovery - you're using store & forward.

As a quick proof of concept, I'd set up an email server, and build an application that sends emails to addresses registered on that server, encrypted using PGP - the tooling and libraries are available, so you should be able to get that up and running in days, rather than weeks. In my experience, building a throw-away PoC for this kind of question is a great way of sifting out the nugget of my idea.

The second issue is that the nature of a social network is that it's a network. Your design may require you to store more than the data of the two direct contacts - you may also have to store their friends, or at least the public interactions those friends have had.

This may not be part of your plan, but if it is, you need to think it through early on - you may end up having to transmit the entire social graph to each participant for local storage, which creates a scalability problem....