Introduction to Peer-to-Peer Networks | Lecture 01

[00:00:00][Music] [Music] so welcome to the course on peer to peer network i am offering this course for the first time as a mooc this is lecture number one where i will be introducing you to the various basic things about peer to peer network and as we go along we will explore more and more about this for my introduction i am professor vayne singh and i am in iit kanpur and this is a website where actually you can find information about myself and this is my telegram id over which you can communicate to me if you want the reference material for this course will be available at the telegram channel with this string t dot me slash p two p underscore m o ok mooc i will be posting all my lecture notes in fact all video recordings which will be made here will also be available there and some of the material is available at brashpathy.nmeict.in where i have pushed in the lecture notes or the study material which have been used in my courses the variants of the same course which have been taught in iit kanpur for in regular semester for pg students now let us come to why we require this p2p network we already have internet we already have telephony network we are able to communicate with each other and still we talk about peer to peer networks and what is this peer to peer network is actually so for this we need to understand what is the conventional network the internet which so call or the telephony network and what is lacking in them and because of that gap we are we are trying to go to peer-to-peer systems so if you look at the conventionally or what happens normally nowadays you will we call it client server technology there is always a server ok which you can all identify by their names so for example you go for checking your mail on google so you will always identify gmail.com as a name of that server so this somehow on the internet will get converted to a other address of the server machine and from your machine or your laptop or your desktop or your browser or your browser on your mobile phone you will be connecting to this server okay now the program which in your browsers mostly will communicate with this www.gmail.com will mostly will be a browser and this browser will be sending request over the internet which you can see here ok so this is internet this will go to the web server which in turn will talk to an application which you can see here this application is can be flat web pages or can be some logic which is dynamically generating web pages for you and with the red path you will be returning all the way back to the browser and that is how when you want to view an email so a command goes all the way to the web server and then a new page will come back will show what is your email id we are slightly more sophisticated because we run in browser small application which talks to web server and fetches the information and displays it to you continuously similarly we can think of another application called mail so we all have been sending emails so the client which i use on my desktop or in on my laptop is thunderbird you might be using a gmail client in your mobile android mobile phone or you might be using something else okay so in that case these clients will normally talk to something called imap server internet message access protocol mail access protocol and smtp simple mail transfer protocol smtp servers so when you want to send an email your client will use this smtp protocol the protocol is set of rules which have to be followed by the two end points or two sides on the across the network so that they can understand each others language so there is a set of rules which have to be framed for communication this is what we call protocol and these are formally documented so for receiving the email to your client you use image connect to imap server for sending it you again give it to an smtp server so but server is very sacrosync they have to be available 24 by 7 okay they cannot go down and they have to have a huge capacity so that they can serve large number of users who are connecting from their laptops or desktops or mobile phones okay and of course in case of smtp servers we even define zones so iit kanpur will have one smtp server and one imap server and we talk to imap smtp server of other institutes for transacting the mails and whenever this clients will talk to smtp server they will do authentication so that when you are sending email we have a record you logged in as which particular user when you have given send the mail through the smtp server so this is used in case of if we need to investigate who was the original person who actually has submitted the mail so this is kind of a security system now this ah actually means we will have machines in the net and so these there will be many clients which will connect to the server that's one of the key things here so there can be thousands of clients which can connect to server now here you should think if google is also running a mail server www.gmail.com on a browser there will be billions of people trying to connect to google at any point of time a single server probably cannot handle this so they normally use not one but multiple servers and different people will always connect to different servers so maybe everybody who is in up area is connecting to one specific server somebody else is connecting some other specific server they essentially do partitioning to create to support large number of users and now one of the problems with this server based thing is that owner of the server will have lot of private information of yours so google as of now might be holding talk knowing about your phone number they know about them will not be knowing about your password because when you send a password they will immediately convert into a hash i will talk about what the hash is as we go along the course so hash is basically in a layman's term for now as you take any string you pass it through hashing function it will give you a certain number of bits and if you know these bits you cannot get back what was the original information from which this was generated but if you know the original information you can find out the hash so it is a one way transfer one way mapping from infinite set to a finite set so normally all passwords are being hashed and this hash value is kept in a table so the owner of the server will not be able to find out what is your password but if you give the password he can compute the hash and match the hash and make a guess that yes password is correct yes there is a finite possibility that more than one password may map to same hash value so but chances that this collision this is what we call collision chances this collision happens is extremely low so most of these devices work on that principle ah that is one problem with the server-based system so lot of this private information being available and if somehow a compromise happens on the server or the owner itself goes rogue actually so then they will have lot of information about you so normally users would like to have the right over the information about them they do not want anybody else to know so it should be the right of the user to tell who should know how much about him so that right to privacy is important so normally this will be handled as of now by regulation of the government which will be applicable to the server owner of course we do get into trouble if the servers are residing outside india then indian government cannot control the owner so normally we require because of this that servers of any internet service which is being provided in india any kind of application the servers have to be maintained within india so that the information is not outside and government of india can actually control or access that information on need basis ok so the law actually allows this and now the second problem which happens is these servers need to be extremely powerful machines and they need to have huge storage and they need to have extremely high reliability so normally this is done by running multiple servers and they act like hot standby even if one server fails the other machines automatically takes over we have those kind of mechanisms to be built and because you want high reliability good air conditioning systems so extremely so all these will essentially be set up in data centers so cost of running a data center will also be huge so this essentially entails lot of infrastructure cost if you are going to go with client server thing but this was required in past because good computing was costly so people were actually having their end devices were low cost low compute power low storage kind of devices so anything which is costly was shared among large number of people that's where the server concept actually came in so initially they used to be compute servers so used to do telnet telnet is a program by which you can log in into a machine and run your programs there so that's how it started is a sharing of resources to reduce the per user cost so that was the idea why servers actually came into picture there was our shared resources and of course now this sharing is leads to reduction of cost per unit of compute or per unit of per user so this lower cost was essentially the driving force behind having servers all across and so now this become kind of a de facto thing so everybody has been talking about servers only and talking about data centers and people will access services from there but things have changed over time so this good business principle of sharing costly resource so that utilization become very high and which will reduce the cost has to change now technology has changed and cost of compute has gone down drastically ok so now even look at personal devices what's the situation with them they are more powerful than what they used to be there in past so even in fact some 25 years back if you look at a super computer now your mobile phone which is octa-core running at more than two or three gigahertz having 12 gb of ram probably that mobile phone is more powerful than that super computer so handled mobile phones with 12 gb of ram 256 gb flash storage 1gbps wi-fi 2 gigahertz clock rate or even higher are kind of very common things now so with such a kind of powerful thing and they act as client then you need servers of very high capacity and of course you will not be able to use these devices fully unless servers of extremely high capacities are actually being built or alternately server will be able to handle now less number of users okay now we also have a drastic change the storage cost has gone down you can see 256 gb is a huge space and maybe in time to come mobile phones with one terabyte kind of space flash storage will be viable ok so this actually means now lot of compute is available and resources are available at the user end so servers are probably has to go now another thing which has happened is capacity of networks has increased drastically because optical fiber has been inducted and now you can easily think of 10 gbps or higher links in fact iit kanpur has two 10 gbps links which we cannot could not have imagined when i joined this profession here and when you want to build up servers to cater to these devices so either number of users per server has to go down or server has to be also their capacity has to increase their compute their storage their bandwidth test everything has to go up so this will become more costly so now idea here actually comes that why we cannot combine the compute of the user and devices their storage and because we have now very high bandwidth available even to the user connect all this and network all this capacity together to build up the systems instead of using servers so we can can we do away with the servers that's a question and certainly it should be feasible and that is what the peer to peer networks actually talk about now normally what kind of applications are existing on the internet let us let us look at that so the networks which are or internet is basically being used for communicating the captured or generated information you are doing facebook you are either getting information or you are generating information and pushing it to the network and other people are accessing it so this is not over space not its not immediate also it is also over time so you do it now today somebody else get it tomorrow so immediately only over space if you want to do it telephone is a good solution its a live thing so alive as well as live as well as non-live kind of communications both are supported you also store the information that actually implies you store it for archival purpose you store it for later on access and once you start storing you also can index the information you can derive more information based on the indexing or processing so all this functionality what has to go in the server actually now all this communication all these capabilities which happens because of the network and servers have to be now can can this be done when i build up user machines being assembled together to build up a distributed serverless system essentially or we call it peer to peer system so now there are actually problems the moment i talk about this so let us look at what specific problems we are going to get in a client server system because we have to address each one of these issues when we think of designing a peer to peer system so i am specifically mentioning those things so here you can see in a client server thing there are two nodes which are one and two here being put they are being connected to through an internet which is again i have shown and they are connecting to server and these servers can need not be one they can be multiple clusters of server but for the user they only being visible as a one single machine now these servers need to have a fixed i p address so every machine on the internet for routing the packets its a packet swiss system internet sending information to him we need i p address if we are following tcpip network so these are these are going to have a fixed i p address that is one important thing but while your mobile phone when you are using it so you change your location its ip address keeps on changing dynamically all the time because this ip address is being allocated through a server which is a small dhcp server in the various zones of a telecom operator ok so clients mostly are going to have dynamic addresses while servers are mostly based on static addresses that is a current way of handling the things and these server addresses will can be ipv4 can be ipv6 both 32 and 128 bits both now when you change your location because of mobility your ip address has to change so that the packets can be routed to you so different zones will there because we need routing aggregation i do not need to maintain routing tables for every device for a zone i will keep one routing table entry at other places so all addresses have to be somehow related so when you move into a zone your address has to change and that's why dynamism of ip addresses do come for the clients because clients are mobile servers are not supposed to be mobile they are static they are at one place okay so they can have fixed ip addresses maybe one option which you can have is let the if the clients have to work like server so they can actually tell about themselves to continuously to the mechanisms which are going to be identify where the server is i will talk about that but normally what each client does as of now is it will it will be depositing the information to server you are doing it to facebook when you are running facebook client you are retrieving the information from server you are asking it to process some data what we want to now make a change is that there are no servers you want the information you fetch it directly from the other clients other users you want to give the information and give it to other users okay and you want to process you actually yourself process it or you ask some of your the client to process it but the problem is other clients they are mobile their end point addresses will keep on changing our ip addresses will keep on changing they may not be on because you turn off your mobile phone you can turn off your laptop when you are not using it so that reliability of servers is missing ok and the static nature of ip address is missing and still we want to do the function so let us see how it happens through indexing servers ok so normally the idea here will be that if somehow we maintain something called indexing server we need to at least maintain something like this that is a naturally occurring way of solving this problem so every use every period client for example here option all pair clients can talk to each one of them i have not shown all the links so there are seven of them so it will be seven c two ok so seven into 6 by 2. so it will be 21 links which will be there among them so that they are all connected to each one of them so is the overlaid network so they can over the internet can directly communicate to each other so that is a virtual link now we need to also maintain a server so each one of them will publish in the indexing server what kind of resources it has and what is its i p address so when somebody wants to search for a resource it goes to indexing server and indexing server will search through the resource will then find out who has this particular resource what is i p address and port number and then you can directly make a connection and fetch the resource so indexing server is a central repository through which you can identify who has what resources we even do it now you want to for example find out something about want to learn about some content for example you want to find out how what is coronavirus you what you do you normally go to www.google.com and put in coronavirus in the search engine and as a consequence you will get a list of lot of websites which are mostly static websites because they are fixed ipr this is assigned to them there is not the user client machines but you say index so google.com basically maintains a index so it creates search index by crawling through all the static web pages all across the world static and dynamic both kind of contents ok and once you get this thing you can fetch from that server so instead of client you are fetching it from server and these are mostly static addresses when you want to build up this kind of index you require dynamic addresses to be handled and one very important thing because nodes are acting as a server as well as client in a peer to peer system this network should never get partitioned okay so there has to be we create technically an overlay into this they should i should be able to reach i should be able to know everybody basically if i know who are my neighbors they know who are their neighbors so it's basically knowing about the information is not maintaining connections is a reachability so reachability to every node in the npr network should be maintained so network should never get partition so that one half of the network does not know even a single node from the other side and these two cannot reach to each other that should never happen so that requires a kind of a trick ah i will explain how that is going to be done when we talk about peer to peer routing tables ok so now these all can maintain now this index the centralized index which i talked about earlier this will now have to be managed in a distributed fashion can this be done so not only this distributed fashion in which i am going to store all the index entries will allow me to create maintain the entries but also it will give me a method by which network will never get partition that can also be guaranteed ok this is what we call logarithmic partitioning so now this is what i was talking about each client need to find out figure out somehow that who has the resource so now what could be this resource let us talk about this resource so this can be a file so that is what you do with the web page you are trying to search for corona virus thing so who has published the files about coronavirus so you go to google search into the index get the urls and click on that and directly fetch the file from the other servers there can be services also for example you want to make a telephone call to somebody okay so this what happens in sip telephony session initiation protocol so more all modern day telephony is based on that so you normally every phone will get registered to the sip server so shift server maintains index of which user id is mapped to which i p address and port number as of now and this keeps on changing every few minutes so as your ip address changes your record will also keeps on changing when you want to make a phone call you go to sip server find out the ip address and port number of the your destination to whom you want to call fetch it and then you set up a call through that ship server you can similar to iptv streaming it is a live thing it is a service so service also can be searched and can be connected to ok you want to do a compute for example you can go to this thing and find out the compute service where it is available connect to that service and do the compute so is a resources can actually be files as well as services both an important thing is end point identification so that is a crux whether doing it through indexing server or through a distributed mechanism and if it is going to be kind of a distributed system where these are all mobile clients which are acting as server they need to tell every time the key with which they need to be searched for example i am providing a file on coronavirus whenever my ip address changes i should tell indexing server k update my address to this and this is the key for which i am holding the document so key will be the keywords by which you search the document and you will end up in getting my address ok so key and end point address that is basically search key and what is the corresponding value of that key so this has to be updated by all the mobile clients so that addresses can be changed that has to be the one change which has to go with the static addresses this is not that much of a problem and normally is a google which runs crawlers and searches the web to maintain the index it was not the applications or the user end which was updating the index but now situation is different with peer clients so we can actually have this dynamic index update so we have on a similar concept dynamic dns so your name remains the same but your name to ip address mapping has to change so as your client machines ip address keeps on changing you keep on changing your dns entry but the entry which is maintained in the google is based on your dns name so they need not do it on google google always keeps the resource with the domain name so it will tell coronavirus.iitk.com will be the name so name to ip address mapping you can change in dynamic dns that's what can be used now lot of small businesses use this to maintain their websites so now there is one important thing in peer to peer systems user clients in current thing it is a endpoints or server and as i mentioned just now that they will always be identified by names not by ip address there is also reason why this has to be done because people cannot remember i p addresses names you can always remember ok so you know that you have to go to www server of iit k you always say w w dot i t k dot e c o tin you do not have to remember the i p address and i can always keep on changing the i p address ok and you connect to this i browser will connect to the i ip address on a well defined server port so these also have been identified so for web service it is port number 80 which is used for secure web it is 443 for proxy cache it is 8080 there are many ports which have been defined and only change now we are making is now resource providers will be the user machines so we have to also do away with this well known identified port numbers so port numbers can be dynamically changed and we have to also take care of the index in a distributed fashion so as i told google can provide dynamic updates so user machines can update it dynamically port number as well as i p address both the content identifier and as well as the transport protocol both okay we will just change this to a distributed system later on this centralized indexing so this way now anybody can connect to the user machine and then fetch the data but here one of the problems is how you will be sure that the user machine is an authentic machine is authentic user so what he is telling that he is actually he is so there has to be a way to do it on servers this is done in a certain specific fashion using basically security certificates and the risk with this content with the user machines is that as i p addresses change periodically they are they need to be updated so but you have to verify this guy is genuine all the time even when i p address is changed somebody else is not faking as that guy so security issue has to be handled so the problem which can happen is some rogue node can register its i p address and can provide incorrect content how that will be taken care of ok so even the websites can be spoofed but websites spoofing now has been more or less resolved by forcing the browsers to use https protocol otherwise there is a warning which is being shown to you now this s stands for secure secure http so you can verify the site name whether it is a generally the owner of that site name is that machine or not can be done this verification can be done so we need to understand public key cryptography for this ok so this we need to understand so let us move to that so what is this pki so this is essentially means that we can generate a public key and private key and a good thing is that both have to be generated together okay you can't generate one you can't know public key and find out from their private key or you cannot know the private key and then find out public key that is not feasible so both have to come out at the same time from the algorithm one of the popular algorithm is rsa algorithm for doing this ok and there is now even a better variant curve cryptography based system is also has come by which also the similarly two keys can be generated so now one important thing is if i have key one for example i take private key i take this content and i use a hashing function and is basically key dashing i can give key as an input content as an input there is a hash which gets computed hash is a fixed length string okay if i change my key my hash will change if i change my content then also hash will change ok so same content signed by different keys will lead to a different signed hash okay so this mechanism actually can be used now as i said that two keys have to be done together and knowing one you cannot find out the other that is a key thing now this key pair one of them can be private become private other one can become public key it does not matter how you do it but both is like a pairs and the algorithm actually came with reverse shameer and edelman from mit actually they gave this algorithm keep your generation and the problem here is you take two large prime numbers make a product of them and you will get a number now doing the reverse if you know the large number finding out the prime factors is a difficult problem actually and that's basically the basis that finding out two large prime factors of a large number is difficult that's what is being used to essentially create this whole system now this is the basic property as i told that one key will be used will be known as private key and it should be only known to the legitimate user who actually owns the key other key is public so the other public key will be known to everybody so this guy will tell my name is so and so this is my public key ok so this public keys anybody can keep it now what you do is if i want to publish any content it will take the content i will use my private key ok and then generate a hash and this hash with the publish along with the content so these two things will be put together and will be published to the users now users will have the corresponding private key so there is a corresponding private key ah corresponding public key sorry and this public key can be used to verify whether this hash was indeed generated by the corresponding private key and the content so if the hash match does not happen then there is a tampering in the content or the hash either must have been done during the transit so nobody can tamper so we can do temper proofing of the content with this so that is a signature process ok now this is where i have shown it if a content is tempered you use your public key you input compute the hash you also put in the hash the verification will fail unless this public key corresponds to that private key and content is as it is intact so even a single byte single bit is being modified the verification is going to fail this is what is the basic digital signature mechanism we can also use the same thing for doing encryption so you take a content you insert the public key okay and you run through encryption algorithm and you will get encrypted content ok this encrypted content when received by the user only he has the corresponding private key he has to use this private key this encrypted content and he can get the decrypted content back so original content will be recovered now you need to understand that nobody except the guy who holds the private key can decrypt this so this is pretty secure its asymmetric public is known to everybody so everybody can send encrypted information to one single guy so nobody else can read it okay so these two things in combination actually can be used to build up our system this https which i was talking about verification system for a website we have to use something similar in peer to peer system so now one thing which you have to ask we should actually ask anybody who is logical will always ask when i am doing signatures here why i am not using a public key so when i want to generate a hash why not public key now if you can do it anybody can generate the hash so it does not make sense if signatures are done with public key they are useless anybody can do their signatures signatures should only be doable by the owner nobody else so it has to be done through a private key because he is the sole person knowing the private key okay similarly doing encryption with a private key does not make sense because anybody who holds a public key which is known to everybody in the world they can decrypt the information so there is no use of doing that encryption if anybody can read it ok so encryption is always done with public key and signatures will always be done by private key other other key will be always used for the reverse process ok so normally the way it is done is that we have to create infrastructure so we will have something called trusted authorities certification authorities and their public keys will be well known to everybody so if you look into your browser you can go into settings passwords and security inside this there will be trusted certificates so i think every few months there is going to be a browser update or operating system update and this certificates will get updated so is basically the trusted public keys on which you have a trust so these are certification authorities okay so these are distributed periodically and these are used to check essentially if the other end is genuine or not genuine and these are kept in a trust store we call it a trusted public keys and we call it a trust store where the trusted information is kept now public key normally is given as a certificate ok so it will have a unique id email mobile adar may be other details you can put your public key there ok and this information now can be signed okay and this signed hash can be generated by a certification authority so there can be another in field here which will mention that who is the certification authority here so this c authority will use its private key to generate the signed hash so now anybody who is going to look into this will look at the c authority signed hash it will then look into its own trusted store whether it c authority exists there ok and that c authority certificate will be a public key which will be very which will be there in trusted store you it will use that public key to verify the signed hash and once this signed has been verified the guy is genuine so this all information is fine the public key which is being mentioned is also fine okay so public key which is stored in the certificate is used to verify if it is indeed signed by the owner of the corresponding private key so we can actually have extra information if you wish in this certificate which can be self signatures which can become part of the certificate itself so that depends on how you configure but normally the self signatures are not required so whenever you are going to generate public private key you will be creating only this information your unique id email id mobile number everything and your public key this information you will be giving it to certification authority which in turn will do one thing it will verify each and every information provided by you for example your email id by sending an otp your mobile number or maybe other number through an otp once that is being done otp so this information is verified you are the owner of that email id that will verify indeed that you actually have the private key or not for the public key which you have submitted so it can generate a random number which then can be encrypted with this public key can be sent back and the client can decrypt it back and send it back through the public key by encrypting again through public key of the server and then the certification authority will get the everything intact back so the guy who submitted the request owns the private key as well as he also is having access to the email id or whatever other credentials which are there so it will now digitally sign the certificate by its own private key and send the certificate back now this is very important so servers also keep these certificates with them okay so there this is the generally the method used but we can do it the other way around where self signed certificate is further signed by a certification authority but that will ensure that extra step of verifying whether the the guy who has submitted the certificate generation request holds the private key or not that has to that step can be avoided because that automatically gets added to the system so in our design when because this whole thing which i am teaching is based on a development project which has been going on here in iit kanpur i call it brahmati 4 which is a peer to peer system not only it will provide lms but other facilities also so we have already built a lot of part its open source project available on github so i am basically teaching from there so we have done the design of the certificate in slightly different fashion but in real life it is done in a different fashion but this is still flexible so this is what i was talking about if it is a self signed certificate only owner could have created it so you do not need to do the verification of that and when ca signs it it means this was a genuine guy email and everything has been verified by c authority and ca's public key will would have been there interested trusted store of all the clients so they can accept it so normally this is the format which we have been designed for brashpati for but this this hash this particular part of the hash will only not be there if i am going to use the conventional structure but in our structure we have actually kept it so just to actually avoid one more step ok so this is how the certificate will actually look like so we are now able to verify the ownership of this email id we are able to verify whether this corresponding private key of this public key is available with the user or not and then this hash and this public key see a thing is available in trust store of others so they can always now have faith on this if the public key of ca which they have in their trusted store through which they can verify this and figure out the hash ok so once they figure out the hash is justified is verified then this all is genuine so then they can actually figure out talk to the ssl talk essentially a small mechanism by which they can figure out whether this is a genuineness of the other end can be found so let me go through it and you will appreciate this one so now this comes to the s part so how this certificate will be used to verify the server end when you do https now stands for secure socket layer ssl and this is used for verifying the ownership of the domain name and then you also use it for creating a secure channel to the servers so s is not only used for verifying the identity of the server but also to create a secure channel all the way to the server so for example www.google.com will have a private key corresponding to a certificate given to the domain owner okay so domain owner is again google and this certificate must have been signed by ca certification authority whose public key must be there in your trust store in your browser ok so the process will go something like this this is a symmetric one so when your browser which is a here i call it this is basically the principle of ssl its not exactly the ssl or secure socket layer so a will talk to server it will request for the certificate so server will return the whole certificate intact and certificate a will verify if the certificate is indeed signed by a trusted ca and it will give warning to user if it finds out its not signed by a trusted ca or it has been revoked there is a revocation mechanism also so and if it is just verified certificate is fine now it has to the user a has to find out if server actually owns the corresponding private key or not so just presenting say because anybody can present you the certificate the important thing is the corresponding private key is being held by the server or not so for that a will generate a random number i call it sr it will be encrypted with the public key now remember if the server holds the private key then only it can decrypt back the sr otherwise it can't okay so this random number is going to be sent sr will be sent after encryption only if the private key is available here sr can be decrypted otherwise it cannot be ok so once server is gen1 then only the step will move ahead otherwise it won't it will generate another random number called dr it will encrypt with the sr and it will send it back now sr is not being sent in this reverse path ok in this path it is not being sent so this way sr is only used for encryption purpose dr is being sent so once the dr comes back it will decrypt with sr and will generate a new session key srdr now both side i need to generate random numbers so that even if you are using same random number other guy may not be using the same random number and you will have a different session key so you cannot listen to the earlier communication cannot guess the new session keys which will be generated is for that purpose so session key will be computed here same will be done by the server and they will now do a secure communication over this using this session key okay so not only you have verified the server okay you have also now created a secure session but note here the a is not being verified by server a can be anybody a is not presented certificate a has not been challenged to prove that he holds a corresponding has not even may not even be having the certificate that is what happens when you are actually using your browser to access gmail.com now what server can do is it can actually use either otp or it can use a login password mechanism to verify you so you do not have to own a certificate because of that because when you have to own a certificate you have to generate a public private key pair send all your information to somebody as c authority who will charge some money who will verify all your credentials then will issue you a certificate which may be valid for a year ok so that all hassles have been taken care of for the common man so we can actually use this same ssl in a slightly modified way for verifying each other not only server so that way that problem that i p addresses of the users will keep on changing but their user id say email id remains the same so still i should be able to verify the other guy even when i p address is changing there is no nothing like https there so but we can use this same certificate can be used for doing verification okay so for peer to peer authentication we will be using user identity certificate not the domain name certificate while for server authentication it was domain name certificate which were there so this is the process where two user client users or two peer clients will do mutual authentication using this so ca will be the certificate of a signed by a certification authority so when a and b would like to talk a will send a certificate ca to b a b will look into trusted store find out the cas public key we will verify the certificate once it is verified is is verified perfect it will send back this own certificate cb to a cb will a will also do the same process it will look into truss store find out the public key of the certification authority from there it will check whether the hash is correct or not for the certificate if it is indeed it was issued by ca so cb is correct once these two are correct then they can start the mutual authentication process so what they have to do is they have to basically verify whether the other side does hold the corresponding private key for the public key which is present in the certificate so that's a test which has to be conducted so what a will do is it will generate a random number r a it will encrypt that random number with public key of b and will send it to the r a send it to b b should be able to decrypt this r a if it holds the private key for this corresponding to this public key once it is done it knows what is rb and what is r a it will now generate another random number called rb ok this is like a nonce nonce is a random randomized component so that the things do not repeat so rb is going to be again send ra and rb concatenated will be sent through public key after encrypting through the public key of a node a and this will be sent back here so if r a and rb both will be you will be able to decrypt back okay if ra is being recovered correctly which has been sent so this you have verified this guy was the original genuine guy and you have sent back rb available so because of correct r a b is authenticated rb has to be sent back with the public key of b b will be recovered so b is also being generally received correctly received rb so b has authenticated a now they both a and b will now use r a and r b and generate a session key b will also do the same same algorithm so there should be same session key now they can actually talk in a secure fashion with each other they both we have mutually authenticated and they both actually have created a secure session now there is no domain name in the certificate now it's an email id or a mobile phone number for between two peer clients and though that's good enough for mutual authentication so ip address is only for sending of the packets is no more used for authentication domain name is not required and this is a basic method of mutual authentication between two peer clients so for this lecture i have talked about certificates ultimately for mutual authentication and the unique id which have to be mentioned because each peer client will be identified by that as i mentioned can be any one of these any one of these four identities for our design depending on what you are implementing you can actually make the changes for branspathy 4 project we actually have done these four entities so in fact now skype for example is using your email id for doing this verification telegram is using your mobile number whatsapp using your mobile number a telegram actually is using your there is a telegram id authentication is on through mobile phone but they also allow you to generate your unique id and talks is using a 256 bit i think string random string and you can give any pseudo name there there is no i p address anything and talks is also one of the beautiful peer to peer system for messaging and you remain anonymous there so with that i end this lecture and we will explore more about peer to peer systems in the next lecture [Music] so [Music] [Music] you