i2p - invisible internet

[DronVR]

I2P - Invisible Internet

I2P

I2P (abbreviated from the English “Invisible Internet Project”, Russian “The Invisible Internet Project”) —open software created for organizing a highly secure anonymous, overlay, encrypted network applicable for web surfing, anonymous hosting (creating anonymous sites, forums and chat rooms , file-sharing servers, etc.), instant messaging systems, blogging, as well as for file sharing (including P2P — Torrent, eDonkey, Kad, Gnutella, etc.), email, VoIP, and much more. The addresses of sites on the I2P network are in the pseudo-domain space .i2p.

Overview

I2P is an anonymous, self-organizing distributed network that uses a modified DHT Kademlia, but differs in that it stores hashed host addresses, encrypted AES IP addresses, as well as public encryption keys, and connections to the Network database are also encrypted. The network provides applications with a transport mechanism for anonymously and securely forwarding messages to each other. Although the I2P network sets the main task in determining the packet transmission path, thanks to the Streaming lib library, they are also delivered in the originally specified sequence without errors, losses and duplication, which makes it possible to use IP-telephony, Internet radio, IP-TV in the I2P network, video conferencing and other streaming protocols and services.

Inside the I2P network, there is its own directory of sites, electronic libraries, as well as torrent trackers. In addition, there are gates for accessing the I2P network directly from the Internet created specifically for users who, for various reasons, cannot install the Invisible Internet Project software on a computer

Network features

• The I2P network is distinguished by the use of encryption mechanisms, P2P architecture, and variable intermediaries (hopes). This method involves increasing the complexity of deanonymization, MITM attacks and making packet replacement transparent to the user completely impossible.
• Currently, the network element is a kind of implementation of ordinary DNS servers. It differs from the usual DNS in the following things:
• To determine the hash of the recipient, a local address base is used.
• the address database is periodically updated from the name servers, while in traditional DNS the address is determined by a request to it (however, caching has been performed in some OS and browsers).
• Subdomains are not tied to the parent domain, but the address subscription provider is free to restrict the registration of subdomains by permission of the parent domain.
• multiple name servers can be used. In the official implementation of the router, conflicts are resolved according to the “first come, first serve” scheme, but it is worth noting that the hash amounts of the recipient explicitly specified by the user in the address bases “privatehosts” and “userhosts” go first - that is, they have a greater impact than subscriptions.
• since the network is peer-to-peer, addresses are hashes that the addressee's hopes (intermediaries) use to address the addressee's intermediaries.
• name servers are located inside the peer-to-peer network, although it is technically possible to update the database from the outside
• most name servers, in contrast to external name registrars, do not currently require domain registration fees in their database. The main criterion is the availability of the server by the hash of the recipient.
• after creating a tunnel for data transmission, its lifetime does not exceed 10 minutes.
• To create a data transmission tunnel, a unique sequence of nodes is selected each time.
• Since the network is peer-to-peer and decentralized, the speed and reliability of the network directly depends on the participation of people in the transmission of other people's traffic.

To access I2P, you need to install a router program on your computer, which (de) encrypts, (once) compresses the traffic and sends it to peers in I2P. To work with intranet sites, you must configure your browser to forward HTTP packets to a router listening on a specific port. To access the external Internet through I2P, it is necessary to use proxies from within I2P (outproxy), which are currently few. Also, internal sites on the I2P network are accessible from the external Internet through a proxy server.

Network Encryption I2P

The network was originally designed taking into account the assumption that all intermediate nodes are compromised or malicious, therefore a number of active measures were introduced to counter it.

All traffic on the network is encrypted from the sender to the recipient. In total, when sending a message, four levels of encryption are used (pass-through, garlic, tunnel, as well as transport-level encryption), before encryption, a small random number of random bytes is automatically added to each network packet to further depersonalize the transmitted information and complicate attempts to analyze content and block transmitted network packets. The network addresses are cryptographic identifiers, which are public cryptographic keys. IP addresses in the I2P network are never used anywhere and never, therefore, it is not possible to determine the true address of any node on the network. Each network application on the computer builds for itself separate encrypted, anonymous tunnels. Tunnels are basically one-way type (outgoing traffic goes through one tunnels, and incoming traffic through others) - the direction, length, and also which application or service created these tunnels is extremely difficult to figure out. All transmitted network packets tend to diverge across several different tunnels , which makes senseless attempts to listen and analyze using a sniffer the passing data stream. Also, there is a periodic change (every 10 minutes) of already created tunnels to new ones, with new digital signatures and encryption keys (digital signatures and encryption keys, of course, each tunnel has its own). For these reasons, there is no need to worry about applications encrypting their traffic. If there is a lack of confidence in encrypting programs that have closed source code (such as Skype), it is possible to solve the problem with IP telephony programs (such as Ekiga) that transmit traffic in the clear. In any case, the I2P network will perform four-level encryption of all packets and will secure the transmission / reception of all data.

In the I2P network, all packets are encrypted on the sender side and decrypted only on the recipient side, while none of the intermediate exchange participants can intercept the decrypted data and none of the participants knows who the sender is and who the recipient is, since the packet transmitting node it can be a sender, or it can be the same intermediate node, and the next node that needs to send this packet can be a recipient, or it can also be the same intermediate node, the intermediate node cannot find out the endpoints of the sender and receiver, just like cannot find out what happened to the packet just transmitted to the next node - whether that processed it, or passed it somewhere further, it is impossible to find out.

The following systems and methods of encryption and signature are used in I2P networks (for different levels and protocols):

256 bit AES CBC mode with PKCS # 5;
2048 bit El Gamal Scheme;
2048 bit Diffie-Hellman Algorithm;
1024 bit DSA;
256 bit HMAC - Algorithm for enhancing the cryptographic strength of other cryptographic algorithms;
256 bit Hashing SHA256.

I2P Network History

The I2P project was launched in 2003 to support those interested in a new, uncensored, anonymous means of communication and dissemination of information. I2P is an attempt to create a secure decentralized anonymous network with a short response time and the properties of autonomy, fault tolerance and scalability. The ultimate challenge is the ability to function in harsh environments, even under pressure from organizations with significant financial or political resources. All aspects of the network are available as source code and are free. This allows users to make sure that the software does exactly what it claims to be and makes it easier for third-party developers to improve the protection of the network from persistent attempts to restrict free communication.

Many of the I2P development team previously participated in the IIP (English) and Freenet projects. But, unlike the latter, the Invisible Internet Project is an anonymous peer-to-peer distributed communication environment with which any traditional network services and protocols, such as email, IRC, HTTP, Telnet, and distributed applications, such as databases, can work Data, Squid, and DNS.

Source Chipollino Onion Club