去中心化的用户身份验证——可能吗？
我正在设计一个完全分布式 P2P 消息应用程序。
编辑：不仅仅是任何消息应用程序——特别是公共论坛。消息从一个邻居传递到另一个邻居，因此消息可能来自原始作者以外的其他人。通信的保密性并不重要。然而，消息作者的验证至关重要。
这个问题需要介绍一下：
在客户端-服务器模型中，每个客户端都可以确定消息的来源就是消息所说的内容，因为有一个“中间人”身份验证服务器来检查用户的凭据（用户名、密码）在将消息中继到接收客户端之前，匹配内部秘密数据库中的条目。
问题是：这可以在纯 P2P 中实现吗？
假设每个客户端都存储完整的用户凭据集。当然，不同之处在于客户端不能查看它们——因此它们将以加密格式存储。必须检查加密凭据是否与另一组加密凭据相等，而无需完全解密任一组。
这可以做到吗？有更好的方法吗？
（记住：100% P2P。没有服务器。）
I'm designing a fully distributed P2P messaging application.
Edit: Not just any messaging application -- specifically a public forum. Messages are passed along from neighbour to neighbour, so messages may come in from a peer other than the original author. Secrecy of communication is unimportant. However, verification of the author of a message is vital.
The problem needs an introduction:
In client-server models, each client can be sure that messages' origins are what the message says they are, because there is a "middle man" authentication server that checks that the user's credentials (username, password) match an entry in an internal secret database before relaying the message to the receiving client.
The question is: Can this be implemented in pure P2P?
Suppose each client stores the full set of user credentials. The difference is of course that clients cannot be allowed to view them -- hence they'd be stored in encrypted format. The encrypted credentials would have to be checked for equality against another set of encrypted credentials without ever fully decrypting either set.
Can this be done? Is there a better way?
(Remember: 100% P2P. No servers.)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我建议您研究一个名为信任网络的模型。例如 PGP 使用它来分散身份验证。
这句话总结得很好：
I suggest you look into a model called Web of trust. It's used by for instance PGP to decentralize authentication.
This quote summarizes it pretty well:
您需要查看PKI。基本上，用户被分配一对密钥，公钥和私钥。要签署消息，您只需使用您的私钥对其进行加密即可。任何人都可以使用您的公钥对其进行解密，因此如果有效，它必须已由您签名。
有一大堆问题需要理解（主要是密钥交换），这就是上面的“信任网络”答案的来源......
它解决的问题本质上是 - “我们如何知道我们获得的公钥真的属于我们认为他们属于的人吗？
You need to take a look at PKI. Basically, users are assigned a pair of keys, public and private. To sign a message you simply encrypt it with your private key. Anyone can decrypt it with your public key and therefore if this works it MUST have been signed by you.
There are a whole bunch of issues to understand (primarily key exchange) which is where the 'web of trust' answer above comes in...
The problem that it solves is essentially - 'How do we know that the public keys we are getting really belong to who we think they belong to?'