Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's assume that a legitimate torrent file has been safely and successfully downloaded over HTTPS and perhaps even OpenPGP verification was used to verify the integrity of the torrent file.

How good are torrent clients against attackers who want to add malicious content to the download?

Does torrent clients only catch disruption due to network failure or any kind of of attack?

Does torrent clients only use SHA1 or a stronger hash algorithm, were fewer people argue whether its still secure or not, such as SHA256?

(I am NOT asking about any privacy/piracy/legal aspects here.)

share|improve this question
up vote 10 down vote accepted

BitTorrent uses a method called Chunking, in which files are divided into 64 KB – 2 MB pieces and each piece is further divided into 8 KB – 32 KB chunks. Each chunk is hashed and the hashes (along the chunking information) are stored in the torrent's metadata (the small .torrent file, or the metadata you receive via DHT). That, along with the info_hash, makes BitTorrent quite resistant to intentional tampering (poisoning). SHA-1 is used in the info_hash and to verify the chunks.

The University of Southern California has made study on the subject:

We discover that BitTorrent is most resistant to content poisoning.


Because the index file is distributed outside of the P2P file-sharing system, each chunk can be verified with a reliable hash contained in the metadata. This verification provides BitTorrent protocol with high resistance to content poisoning.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.