Security Threats and Mitigations

Open P2P networks are adversarial environments. Any peer can join, there is no central moderator, and the attack surface is every participant. This document catalogs the major threat classes and their defenses.

Sybil Attacks

Threat: An adversary creates many fake identities to gain disproportionate influence over DHT routing, PubSub voting, or storage decisions. Since identity creation is free in most P2P systems, Sybil attacks are always possible in principle.

Mitigations:

Proof-of-work / proof-of-stake: make identity creation computationally or economically costly.

Social trust graphs: require introductions from existing trusted peers. SSB's follow graph is inherently Sybil-resistant—fake identities nobody follows have zero influence.

Costed identities: bind identities to scarce resources (IP addresses, phone numbers, hardware attestations).

Rate limits: cap operations per identity per time window, limiting the damage any single Sybil can do.

Behavioral reputation: GossipSub peer scoring evaluates behavior over time; newly created Sybils have low scores.

Eclipse and Routing Attacks

Threat: An adversary surrounds a target node with malicious peers, controlling all its connections and DHT routing. The target sees only what the attacker wants it to see.

Mitigations:

Neighbor diversity: ensure connections span different network prefixes, ASes, and geographic regions. If all your DHT neighbors are in the same /16, something is wrong.

Bucket hardening: restrict which peers can fill DHT k-buckets (e.g., by requiring long-lived contacts, limiting peers per IP range).

Signed routing records: peers sign their DHT entries with their identity keys; relayers cannot forge them.

Path randomization: vary lookup paths to avoid predictable routing through attacker nodes.

Disjoint-path lookups: query along multiple independent paths and compare results.

Spam and Denial of Service

Threat: Flooding the network with junk messages, invalid blocks, or connection requests to exhaust resources of honest nodes.

Mitigations:

Reputation/score-based penalties: GossipSub scores peers on message validity and timeliness; low scorers are pruned from the mesh.

Challenge puzzles: require computational work before accepting connections or messages (hashcash-style).

Quotas and priority lanes: limit per-peer resource consumption; prioritize authenticated traffic from known-good identities.

Backpressure: signal overload to upstream peers so they reduce send rate.

Amplification prevention: ensure responses are never larger than requests to prevent reflection attacks. Critical for UDP-based transports.

Content Poisoning

Threat: Serving corrupted data for valid content addresses. The hash won't match, but the attacker wastes the victim's bandwidth and time.

Mitigations:

Merkle proofs: verify each block against the root hash before accepting. Content addressing makes detection automatic.

Multi-provider verification: fetch from multiple peers and compare; ban providers that serve bad data.

Trust pinning: prefer known-good providers and pin verified content.

Authenticated metadata: sign manifests and indexes so metadata can't be spoofed even before block verification.

Traffic Correlation and Deanonymization

Threat: Observing traffic patterns at multiple points to link anonymous users to their activities, undermining privacy and anonymity networks.

Mitigations:

Entry guards: use a small, stable set of entry relays to limit the adversary's chance of controlling the entry point.

Path constraints: avoid circuits through the same AS or jurisdiction.

Timing obfuscation: add random delays, batch messages, use cover traffic.

Network-level defenses: use Tor or I2P as an underlying transport for P2P protocols that need anonymity.

How Security Connects to Everything Else

Security crosscuts every layer: Overlay Networks face routing attacks. Transport faces connection flooding. Storage faces poisoning. Identity faces Sybil. Privacy faces correlation. State sync faces malicious operations. Testing and Operations covers how to validate defenses through simulation and chaos testing. Compliance provides the legal framework for responding to attacks. The design patterns of layered architecture and defense in depth apply directly.