Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why can't torrent traffic be encrypted? [closed]

Tags:

The goal of this question is that I am just trying to better understand the nature of P2P and networking and security / encryption. I am a front-end web developer and my knowledge of the networking stack is not great if we go lower than HTTP requests.

That being said, I am trying to understand how torrent traffic is "sniffed" by ISPs and the content identified. I feel like this question will expose my ignorance, but is it not possible to have some sort of HTTPS-like P2P protocol that would not be so readable?

I grasp that a given packet has to identify its destination to the network along the way, but couldn't torrent packets be configured to show ONLY their destination, so that nobody could identify its purpose along the way, until it arrived at its destination? Why is it apparently an unrectifiable situation that ISPs can just look at P2P traffic and know everything about it, yet SSH is extremely safe?

like image 381
temporary_user_name Avatar asked Apr 19 '15 06:04

temporary_user_name


People also ask

How do you avoid ISP from knowing you are torrenting?

A VPN, or Virtual Private Network, encrypts your internet connection and routes it through an intermediary server. This protects you while torrenting in two important ways: The encryption prevents your internet service provider and any other third parties on your network from seeing what you're downloading.

Does uTorrent have encryption?

Enable Encryption in uTorrentOpen uTorrent, go to Options > Preferences, and then click where it says BitTorrent on the left. Under where it says “Protocol Encryption,” choose Enabled and click on Allow incoming legacy connections.

How does your ISP know you are torrenting?

Your ISP will only know that you are torrenting when someone who has monitored your IP address engaged in torrenting and proceeds to tip the ISP off. That said, ISPs can usually guess when you are torrenting by analyzing the amount of bandwidth you are consuming.


2 Answers

Every answer here seems to have a different interpretation of the question, or rather, a different assumed purpose of the encryption. Since you compare it to https, it seems like a reasonable assumption is that you're looking for authentication and confidentiality. I'll enumerate a few attempts in decreasing level of "security". This is a bittorrent centric answer, because you tagged the question with bittorrent.

SSL

Starting with the strongest system, it is possible to run bittorrent over SSL (it's not supported by many clients, but in a fully controlled deployment it can be done). This gives you:

  1. Authentication of every peer participating
  2. The ability to pick which peers are let into the swarm by signing their certificate with the swarm root.
  3. SSL encryption of all peer connections + tracker connections

The tracker can authenticate every peer connecting to it, but even if the peer list (or one peer) is leaked or guessed, there's still the peer-to-peer authentication, blocking any unauthorized access.

Bittorrent over SSL has been implemented and deployed.

encrypted torrents

At BitTorrent (in the uTorrent client) we added support for symmetric encryption of torrents at the disk layer:

enter image description here

Everything in the bittorrent engine would operate on encrypted blocks. The data integrity checks (sha-1 hashes of pieces) would be done on encrypted blocks and the .torrent file would have hashes of the encrypted data. An encrypted torrent like this is backwards compatible with clients that don't support the feature, but they won't be able to access the data (just help out the swarm and seed it).

To download the torrent in an unencrypted form, you would add the &key= argument to the magnet link, and uTorrent decrypts and encrypts data at the disk boundary (leaving the data on disk in the clear). Anyone adding the magnet link without the key, would just get encrypted data.

There are some other details involved too, like encrypting some of the metadata in the .torrent file. Such as the list of files etc.

This does not let you pick which peers get to join. You can give access to the peers you want, but since it's a symmetric key, anyone with access can invite anyone else, or publish the key. It does not give you any stronger authentication than you had when you found the magnet link.

It gives you confidentiality among trusted peers and the ability to have untrusted peers help out with seeding.

bittorrent protocol encryption

The bittorrent protocol encryption is probably better described as obfuscation. Its primary intention is not to authenticate or control access to a swarm (it derives the encryption key from the info-hash, so if you can keep that a secret you do get that property). The main purpose is to avoid trivial passive snooping and shaping of traffic. My understanding is that it's less effective to avoid being identified as bittorrent traffic these days. It also provides weak protection against sophisticated and active attacks. For instance, if the DHT is enabled, or tracker connections are not encrypted, it's easy to learn about the info-hash, which is the key.

In the case of private torrents (where DHT and peer exchange are disabled) assuming the tracker runs HTTPS there aren't any obvious holes in it. However, my experience is that it's not uncommon for https trackers to have self signed certificates, and for clients to not authenticate trackers. Which means poisoning the DNS entry for the tracker may be enough to enter the swarm.

like image 111
Arvid Avatar answered Sep 21 '22 07:09

Arvid


Torrent traffic can be encrypted, and there are VPNs/SOCKS proxies that can be used to redirect traffic, i.e., via another country through an encrypted tunnel before connecting to peers. That said, even if you use such services, there are a lot of ways of leaking traffic via side channels (e.g., DNS lookups, insecure trackers, compromised nodes), and most people aren't knowledgeable enough to follow all proper security/anonymity precautions. Furthermore, restricting yourself to communicating only with clients who have also forced encryption will limit the number of peers you can connect to.

like image 36
Oleg Vaskevich Avatar answered Sep 21 '22 07:09

Oleg Vaskevich