What is torrent encryption?

432    Asked by AndrewJenkins in Cyber Security , Asked on Feb 24, 2022

 This question is inspired by an article (in Russian) about a website called I Know What You Download. From what I understand, they scan the DHT networks and display torrents that any given IP participated in, and although it is sometimes inaccurate, it can provide data on Internet usage, and thus presents a threat to anonymity.


Most people suggest using VPN in order to conceal torrent traffic. However, in another article (also in Russian) the same author shares his experience with torrenting over VPN sets in Azure. Apparently, he received DMCA notice for torrenting a film (author specifically notes that he did not fully download the film, and everything was done for the sake of experiment). They provided the name and the size of the file, along with IP address and port.


But, some (if not all) torrent-sharing programs have an encryption feature. For instance, Tixati can even enforce encryption for both incoming and outgoing connections. 


What does this feature encrypt? Name of the file, its contents, size? Could it prevent DMCA notices? If not, what does it actually do?


Answered by Andrea Bailey

The "torrent encryption" hides the content of the torrent data traffic from a casual observer and makes it harder to determine that the traffic is in fact torrent data traffic. It was designed to make it harder for ISPs to snoop on torrent traffic (and either block it, throttle it or send nastygrams). It can also be useful for evading the effects of buggy firmware in network devices*.


The cryptography used is relatively weak. The DH key exchange is only 768 bit with a fixed prime which is almost certainly crackable by a well-funded attacker. The actual encryption is rc4 which is known to have weaknesses though I don't know how relevant they are to this particular application. MITM attacks are possible if the attacker knows the "info hash" of the torrent in question.

Also it only protects data connections. It DOES NOT hide the fact you are present in the swarm from someone scanning the tracker or dht. It DOES NOT stop the copyright enforcers from connecting to your client and downloading a copy of the file from you to demonstrate that you are illegally offering it for distribution.



Your Answer

Interviews

Parent Categories