Content deleted Content added
Rescuing 13 sources and tagging 0 as dead.) #IABot (v2.0.8.6 |
m HTTP to HTTPS for SourceForge |
||
| (9 intermediate revisions by 6 users not shown) | |||
Line 1:
'''Protocol encryption''' ('''PE'''), '''message stream encryption''' ('''MSE''') or '''protocol header encrypt''' ('''PHE'''){{efn|Usually referred to as the more proper ''protocol header encryption''.}} are related features of some [[peer-to-peer]] [[file-sharing]] [[Comparison of file sharing applications|clients]], including [[BitTorrent client]]s. They attempt to enhance privacy and confidentiality. In addition, they attempt to make traffic harder to identify by third parties including [[internet service provider]]s (ISPs). However, encryption will not protect one from DMCA notices from sharing
MSE/PE is implemented in [[BitComet]], BitTornado, [[Deluge (software)|Deluge]], [[Flashget]], [[KTorrent]], [[libtorrent]] (used by various BitTorrent clients, including [[qBittorrent]]), [[BitTorrent client|Mainline]], [[μTorrent]], [[qBittorrent]], [[rTorrent]], [[Transmission (BitTorrent client)|Transmission]], [[Tixati]] and [[Vuze]]. PHE was implemented in old versions of BitComet. Similar protocol [[obfuscation]] is supported in up-to-date versions of some other (non-BitTorrent) systems including [[eMule]].<ref>{{cite web|url=http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=848|title=eMule protocol obfuscation (encryption)|publisher=emule-project.net|date=2006-09-16|access-date=2010-03-11|archive-date=2009-09-25|archive-url=https://web.archive.org/web/20090925023618/http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=848|url-status=live}}</ref>
==Purpose==
As of January 2005, BitTorrent traffic made up more than a third of total residential internet traffic,<ref>{{cite
==History==
===Early approach===
Protocol header encryption (PHE) was conceived by [[RnySmile]] and first implemented in [[BitComet]] version 0.60 on 8 September 2005. Some software like IPP2P claims BitComet traffic is detectable even with PHE.<ref>{{cite web|url=http://www.ipp2p.org/news_en.html|title=News|publisher=IPP2P.org|date=2006-01-04|access-date=2006-01-29|archive-date=2013-05-20|archive-url=https://web.archive.org/web/20130520031545/http://www.ipp2p.org/news_en.html|url-status=live}}</ref> PHE is detectable because only part of the stream is encrypted. Since there are no open specifications to this protocol implementation, the only possibility to support it in other clients would have been via [[reverse engineering]].
===Development of MSE/PE===
In late January 2006 the developers of [[Vuze]] (then known as Azureus) decided to design and simultaneously implement a new, open protocol obfuscation method, called message stream encryption (MSE). It was included in Azureus CVS snapshot 2307-B29 on 19 January 2006.<ref>{{cite web|url=
This first draft was heavily criticized since it lacked several key features. After negotiations between different BitTorrent developers, a new proposal was written and then implemented into the [[Vuze|Azureus]] and [[μTorrent]] betas within days. In μTorrent, the new protocol was called protocol encryption (PE).
===MSE/PE in BitTorrent client versions===
*[https://aria2.github.io/ aria2] supports MSE/PE as of build v1.34,<ref>{{Cite web|url=https://aria2.github.io/manual/en/html/aria2c.html?highlight=encryption#cmdoption-bt-force-encryption|title=aria2c(1) — aria2 1.34.0 documentation|website=aria2.github.io|access-date=2019-05-29}}</ref> but is not enforced by default.
*BitComet version 0.63 was released 7 March 2006. It removed the old protocol header encryption and implemented the new MSE/PE to be compatible with Azureus and μTorrent.<ref>{{cite web|url=http://www.bitcomet.com/doc/changelog.htm|title=BitComet Client Release Notes|publisher=Bitcomet.com|date=2006-03-07|access-date=2006-03-07|archive-date=2010-12-17|archive-url=https://web.archive.org/web/20101217053502/http://www.bitcomet.com/doc/changelog.htm|url-status=live}}</ref>
* BitTornado supports MSE/PE as of build T-0.3.18. As of January 5, 2007, this build is still marked "experimental" on the Download page.<ref>{{cite web|url=http://forums.degreez.net/viewtopic.php?t=7074|title=BitTornado T-0.3.18|publisher=Degreez.net forum|date=2007-01-05|access-date=2007-01-06|archive-date=2017-03-25|archive-url=https://web.archive.org/web/20170325113536/http://forums.degreez.net/viewtopic.php?t=7074|url-status=live}}</ref>
Line 23:
* [[Deluge (BitTorrent client)|Deluge]] supports MSE/PE as of Deluge-0.5.1.<ref>{{cite web|url=http://deluge-torrent.org/?p=15|title=Changelog: Deluge 0.5.1 (11 June 2007)|publisher=Deluge-torrent.org|date=2007-06-11|archive-url=https://web.archive.org/web/20080401062051/http://deluge-torrent.org/Changelog.php |archive-date=2008-04-01}}</ref>
* [[KTorrent]] implemented MSE/PE in SVN version 535386<ref name="ktorrent">[[Subversion (software)|SVN]] [svn://anonsvn.kde.org/home/kde/trunk/extragear/network/ktorrent server]. KDE.org. 2006-04-29.'''Subversion client required'''.</ref> on April 29, 2006.<ref>{{cite web|url=http://ktorrent.pwsp.net/forum/viewtopic.php?t=432|title=Encryption has been added !|publisher=KTorrent.pwsp.net forum|date=2006-04-29|archive-url=https://web.archive.org/web/20070605174155/http://ktorrent.pwsp.net/forum/viewtopic.php?t=432 |archive-date=2007-06-05}}</ref>
* [[libtorrent]]<ref>{{Cite web|url=http://www.libtorrent.org/reference-Settings.html|title=www.libtorrent.org/reference-Settings.html|last=
* [[rTorrent]] supports MSE/PE as of rTorrent-0.7.0.<ref>{{cite web |url=http://rakshasa.no/pipermail/libtorrent-devel/2006-December/000982.html |title=[Libtorrent-devel] LibTorrent 0.11.0 and rTorrent 0.7.0 released |publisher=Rakshasa.no mail archive |date=2006-12-13 |access-date=2007-06-10 |archive-url=https://web.archive.org/web/20070502055625/http://rakshasa.no/pipermail/libtorrent-devel/2006-December/000982.html |archive-date=2007-05-02 |url-status=dead }}</ref>
* [[Transmission (BitTorrent client)|Transmission]] supports MSE/PE as of Transmission-0.90.<ref>{{cite web|url=http://transmission.m0k.org/forum/viewtopic.php?t=2631|title=Transmission 0.90 Released! |publisher=Transmission.m0k.org forum|date=2007-10-24|archive-url=https://web.archive.org/web/20071027022525/http://transmission.m0k.org/forum/viewtopic.php?t=2631|archive-date=2007-10-27}}</ref>
* [[Vuze]] (formerly Azureus) supports the final spec since 25 January 2006 (CVS snapshot 2307-B33).<ref>{{cite web|url=
* [[μTorrent]] premiered MSE/PE 4 days after Azureus with beta 1.4.1 build 407.<ref>{{cite web|url=http://forum.utorrent.com/viewtopic.php?id=5384|title=μTorrent 1.4.2 beta 435|publisher=uTorrent Announcements|date=2006-01-29|url-status=dead|archive-url=https://web.archive.org/web/20060514085453/http://forum.utorrent.com/viewtopic.php?id=5384|archive-date=2006-05-14}}</ref> μTorrent version 1.5 (build 436) was released on 7 March 2006; it was the first stable version of μTorrent with PE.<ref>[http://forum.utorrent.com/viewtopic.php?id=7199 "
==Operation==
Line 45:
== Effectiveness ==
Analysis of the BitTorrent protocol encryption (a.k.a. MSE) has shown that statistical measurements of packet sizes and packet directions of the first 100 packets in a TCP session can be used to identify the obfuscated protocol with over 96% accuracy.<ref name="breaking">{{cite
The [[Sandvine]] application uses a different approach to disrupt BitTorrent traffic by making seeding impossible. Sandvine intercepts peer-to-tracker communication to identify peers based on the IP address and port numbers in the peer list returned from the tracker. When Sandvine later sees connections to peers in the intercepted peer lists, it may (according to policy) break these connections by sending counterfeit TCP resets.<ref name=weaver2009/> Various solutions exist to protect against Sandvine's attack including encrypting both peer-to-tracker and peer-to-peer communication, using Microsoft's [[Teredo tunneling|Teredo]] so that TCP connections are tunneled within UDP packets, filtering TCP resets before they reach the TCP layer in the end-host, or switching entirely from a TCP-based transport to a UDP-based transport. Each solution has its trade-offs. Filtering out TCP resets typically requires kernel access, and the participation of the remote peer since Sandvine sends the reset packet to the local and remote peers.
==Criticism==
Line 55 ⟶ 57:
==References==
{{reflist|colwidth=30em
<ref name=weaver2009>{{cite conference
|url=https://www.ndss-symposium.org/wp-content/uploads/2017/09/weav.pdf
|date=9 Feb 2009
|title=Detecting Forged TCP Reset Packets
|author1=Nicholas Weaver|author2=R. Sommer|author3=Vern Paxson
|conference=NDSS Symposium 2009
}}</ref>
}}
==External links==
* [http://wiki.vuze.com/w/Message_Stream_Encryption "Message Stream Encryption"]. Vuze.
* [http://wiki.vuze.com/w/Bad_ISPs "ISPs that shape BitTorrent"]. Vuze.
* [https://web.archive.org/web/20170711104140/http://www.slyck.com/news.php?story=1083 "BitTorrent End to End Encryption and Bandwidth Throttling - Part I" with
* [https://web.archive.org/web/20160510034323/http://www.slyck.com/news.php?story=1098 "BitTorrent End to End Encryption and Bandwidth Throttling - Part II" with Azureus developers] Slyck News.
* [http://yro.slashdot.org/story/06/02/06/2039241/bittorrent-and-end-to-end-encryption "BitTorrent and End to End Encryption"]. Slashdot.
| |||