How do P2P clients like uTorrent maintain authenticity of files? I am very new to concepts of cryptography so bear with me and feel free to fill in any information that may seem obvious but something you think someone may not know.

At first I was under impression that people use checksums to determine if files are legit or not. Which didn't make sense for obvious reasons… for example it's not hard to get the same sum for different numbers. So all a hacker has to do is make a file with smaller sum and then fill in the rest with garbage that way file would have equivalent checksum, but completely different content. Then later on, I found out that a checksum isn't used at all for this purpose.

So, what is used instead? I’ve been reading that some asymmetric functions are used and that files are encrypted using the destination's public key.

But I am unable to wrap my head around it and say* “ok, this will work in P2P”*.

Let’s say there are files $A$, $B$, $C$ among 10 seeders and I am the receiver. And chunks of them are being sent. How does uTorrent make sure that the chunk received is the chunk it should be getting. Sometimes there is only 1 seeder. So the option of checking what most people have is out of the question…

Thinking about it ,I am not sure how uTorrent or P2P clients really work after all. 

For example:


Does each torrent file has some unique ID? If, how is it generated?
Am I correct to believe that all torrents connect to a server to get the list of all other people?
The only thing that always happens in BitTorrent is that the chunks (pieces of files) are checksummed/hashed with the SHA1 algorithm and compared against the values in the .torrent file. If all the chunks match their hashes, the file is correct – unless there's an SHA1 collision.

Additionally, some .torrent files contain MD5 hashes for each of the files which the client may or may not verify.

Finally, many clients support protocol encryption, where the traffic between peers is encrypted using Diffie-Hellman key exchange, SHA1 and ARC4. This does nothing to guarantee the integrity of files, it is mostly meant to avoid throttling by ISPs and make it more difficult for eavesdroppers to see what you are up to.