1

I am creating a peer to peer program that runs on client computers connecting to other clients. I will be using Boost.Asio. The only options that I am aware of for securing these connections is using TLS, but it is not practical for every client to have their own certificate and self signed certificates are apparently insecure. What other cryptographic technologies are available that do not require registration with a central authority? Especially ones that would be easy to integrate with these technologies, i.e. there are programmatic implementations available.

Also, I was not sure whether to post this on here or on crypto.stackexchange.com, but crypto seemed more focused on implementing and designing cryptography than utilising it. If I have posted to the wrong one please tell me and I will happily move this question. Thanks.

mm865
  • 11
  • 2
  • 1
    Cryptography is usually used to provide both *encryption of content* and *authentication of the communication partner*. The former doesn't require a central authority, but the latter does (well, either that or world where *everyone* already has a well-known public PGP identity). – Kilian Foth Jan 28 '15 at 07:06

1 Answers1

3

... TLS, but it is not practical for every client to have their own certificate and self signed certificates are apparently insecure.

Wrong.

  • Certificates are used within TLS to identify the peer. This identification is necessary to protect against man-in-the-middle attacks.
  • To make use of certificates for identification you have to be able to verify the certificate.
  • The only option to verify a self-signed certificate is to check it against the original certificate or its fingerprint, which thus needs to be propagated in a secure way to all client before the TLS connection can be established. This is possible but does not scale if you have lots of clients and servers.
  • If you instead use a central authority which issues and signs certificates scaling is much easier, because you only have to verify that the certificate belongs to the party (like checking if the hostname is contained in the certificate) and that is is signed by an authority you trust.
  • And to make it even easier browsers and OS ship with a predefined set of trusted authorities (the root-CA).

If you have only secure the connection over the clients (like with a mobile app) you can use a self-signed certificate and distribute it to the clients (outside the TLS connection). Thus there is no need to buy a certificate from somebody.

For more information, see the OWASP guide to certificate and public key pinning.

Apart from that, a good forum for asking these kind of questions is Information Security StackExchange.

Community
  • 1
Steffen Ullrich
  • 201
  • 1
  • 7