diff --git a/pages/how_cryptography.html b/pages/how_cryptography.html new file mode 100644 index 00000000..b3941b54 --- /dev/null +++ b/pages/how_cryptography.html @@ -0,0 +1,158 @@ +

+There are a handful of cryptographic algorithms in use within I2P, but we have +reduced them to a bare minimum to deal with our needs - one symmetric algorithm +one asymmetric algorithm, one signing algorithm, and one hashing algorithm. However, +we do combine them in some particular ways to provide message integrity (rather than +relying on a MAC). In addition, as much as we hate doing anything new in regards to +cryptography, we can't seem to find a reference discussing (or even naming) the +technique used in I2P/ElGamalAESSessionTag (but we're sure others have done it). +

+

ElGamal? encryption

+ +

+We use common primes for 2048 ElGamal? encryption and decryption, and we currently only +use ElGamal? to encrypt the IV and session key in a single block, followed by the +AES encrypted payload using that key and IV. Specifically, the unencrypted ElGamal? +block is formatted (in network byte order): +

+

+

+ |_______1_______2_______3_______4_______5_______6_______7_______8
+ |nonzero|H(data)
+ |
+ |
+ |
+ |       | data     ...  |
+
+
+

+The H(data) is the SHA256 of the data that is encrypted in the ElGamal? block, +and is preceeded by a random nonzero byte. The data encrypted in the block +can be up to 222 bytes long. Specifically, see +[the code]. +

+ElGamal? is never used on its own in I2P, but instead always as part of +I2P/ElGamalAESSessionTag. +

+The shared prime is the + +[Oakley prime for 2048bit keys] +

+ 2^2048 - 2^1984 - 1 + 2^64 * { [2^1918 pi] + 124476 }
+
+

+Using 2 as the generator. +

+

AES

+ +

+We use 256bit AES in CBC mode with PKCS#5 padding for 16 byte blocks (aka each block is end +padded with the number of pad bytes). Speficially, see +[the CBC code] +and the Cryptix AES + +[implementation] +

+For situations where we stream AES data, we still use the same algorithm, as implemented in +[AESOutputStream] +[AESInputStream] +

+For situations where we know the size of the data to be sent, we AES encrypt the following: +

+

+ |_______1_______2_______3_______4_______5_______6_______7_______8
+ |H(data)|      size of data (in bytes)  |  data    ...  | rand  |
+
+

+After the data comes an application specified number of randomly generated padding bytes, and +this entire segment (from H(data) through the end of the random bytes) is AES encrypted +(256bit CBC w/ PKCS#5). + +

+This code is implemented in the safeEncrypt and safeDecrypt methods of +[AESEngine] +

+

DSA

+ +

+Signatures are generated and verified with 1024bit DSA, as implemented in +[DSAEngine] +

+

The DSA constants

+ +

+ +

SEED

+ +
+ 86108236b8526e296e923a4015b4282845b572cc
+
+

Counter

+ +
+ 33
+
+

+

DSA prime

+ +

+

+ 9C05B2AA 960D9B97 B8931963 C9CC9E8C 3026E9B8 ED92FAD0
+ A69CC886 D5BF8015 FCADAE31 A0AD18FA B3F01B00 A358DE23
+ 7655C496 4AFAA2B3 37E96AD3 16B9FB1C C564B5AE C5B69A9F
+ F6C3E454 8707FEF8 503D91DD 8602E867 E6D35D22 35C1869C
+ E2479C3B 9D5401DE 04E0727F B33D6511 285D4CF2 9538D9E3
+ B6051F5B 22CC1C93
+
+

+

DSA quotient

+ +

+

+ A5DFC28F EF4CA1E2 86744CD8 EED9D29D 684046B7
+
+

+

DSA generator

+ +

+

+ C1F4D27D 40093B42 9E962D72 23824E0B BC47E7C8 32A39236
+ FC683AF8 48895810 75FF9082 ED32353D 4374D730 1CDA1D23
+ C431F469 8599DDA0 2451824F F3697525 93647CC3 DDC197DE
+ 985E43D1 36CDCFC6 BD5409CD 2F450821 142A5E6F 8EB1C3AB
+ 5D0484B8 129FCF17 BCE4F7F3 3321C3CB 3DBB14A9 05E7B2B3
+ E93BE470 8CBCC82
+
+

+

SHA256

+ +

+Hashes within I2P are plain old SHA256, as implemented in +[SHA256Generator] +

+

TCP connections

+ +

+TCP connections are currently negotiated with a 2048 Diffie-Hellman implementation, +using the router's identity to proceed with a station to station agreement, followed by +some encrypted protocol specific fields, with all subsequent data encrypted with AES +(as above). Down the line, we will want to use session tags like we do with +I2P/ElGamalAESSessionTag to avoid the 2048bit DH negotiation. +

+We would like to migrate to a more standardized implementation (TLS/SSL or even SSH), but: +

+

    +
  1. can we somehow reestablish sessions securely (ala session tags) or do we need to do full negotiation each time? +
  2. can we simplify/avoid the x509 or other certificate formats and use our own RouterInfo? structure (which contains the ElGamal? and DSA keys)? + +
+

+The basic TCP connection algorithm is implemented in establishConnection() (which calls +exchangeKey() and identifyStationToStation?()) in +[TCPConnection] +

+However, this is extended by +[RestrictiveTCPConnection] +which updates the establishConnection() method to validate the protocol version, the time, and +the peer's publicly reachable addresses (since we don't support restricted routes yet, we +refuse to talk to those who other people can't talk to as well). \ No newline at end of file diff --git a/pages/how_garlicrouting.html b/pages/how_garlicrouting.html new file mode 100644 index 00000000..17c90bcc --- /dev/null +++ b/pages/how_garlicrouting.html @@ -0,0 +1,51 @@ +

+As briefly explained on the I2P/Overview, in addition to sending +messages through tunnels (via I2P/Tunnel), I2P uses a technique called +"garlic routing" - layered encryption of messages, passing through routers +selected by the original sender. This is similar to the way Mixmaster +(see I2P/OtherEfforts) sends messages - taking a message, encrypting it +to the recipient's public key, taking that encrypted message and encrypting +it (along with instructions specifying the next hop), and then taking that +resulting encrypted message and so on, until it has one layer of encryption +per hop along the path. The only significant difference between that technique +and I2P's garlic routing is that at each layer, any number of messages can be +contained, instead of just a single message. + +

+ +

+In addition to the cloves, each unwrapped garlic message contains a sender +specified amount of padding data, allowing the sender to take active countermeasures +against traffic analysis. +

+

Uses within I2P

+ +

+I2P uses garlic routing in three places: +

+

+There are also significant ways that this technique can be used to improve the performance of the network, exploiting transport latency/throughput tradeoffs, and branching data through redundant paths to increase reliability. +

+

Encryption

+ +

+The encryption of each layer in the garlic message uses the ElGamal?/AES+SessionTag? algorithm +(as outlined at I2P/ElGamalAESSessionTag), which avoids the cost of a full 2048bit ElGamal? + +encryption for subsequent messages (using instead a random previously specified SessionTag? plus +256bit AES encryption). +

+

References

+ +

+The term garlic routing was first coined by Michael Freedman in Roger Dingledine's freehaven +[masters thesis], which was derived from +[Onion Routing]. The main difference with I2P's garlic routing +is that the path is unidirectional - there is no "turning point" as seen in onion routing +or mixmaster reply blocks, which greatly simplifies the algorithm and allows for more flexible +and reliable delivery. \ No newline at end of file diff --git a/pages/how_networkdatabase.html b/pages/how_networkdatabase.html new file mode 100644 index 00000000..f00120c8 --- /dev/null +++ b/pages/how_networkdatabase.html @@ -0,0 +1 @@ +[not yet written overview of the I2P network database, old content at http://wiki.invisiblenet.net/iip-wiki?NetworkDb] \ No newline at end of file diff --git a/pages/how_tunnelrouting.html b/pages/how_tunnelrouting.html new file mode 100644 index 00000000..afc560f7 --- /dev/null +++ b/pages/how_tunnelrouting.html @@ -0,0 +1,165 @@ +

+As briefly explained on the I2P/Overview, I2P builds virtual "tunnels" - +temporary and unidirectional paths through a sequence of routers. These +tunnels can be categorized as either inbound tunnels (where everything +given to it goes towards the creator of the tunnel) and outbound tunnels +(where the tunnel creator shoves messages away from them). When Alice +wants to send a message to Bob, she will (typically) send it out one of +her existing outbound tunnels with instructions for that tunnel's endpoint +to forward it to the gateway router for one of Bob's current inbound +tunnels, which in turn passes it to Bob. +

+ +

+ +

Tunnel vocabulary

+ +

+

+

+

+

+

+

+

+

+

+

+

Tunnel information

+ +

+Routers performing the three roles (gateway, endpoint, participant) are given different pieces of data to accomplish their tasks: +

+

+

+

+

+

+

+In addition, there are a series of options that the creator of a tunnel sends when requesting a router +to join a tunnel, such as the expiration date. In I2P 3.0, options specifying the pooling, mixing, and chaff +generation settings will be honored, and limits on the quantity and size of messages allowed during the tunnel's +lifetime will be implemented earlier (e.g. no more than 300 messages or 1MB per minute). +

+

Tunnel length

+ +

+ +As mentioned above, each client requests that their router provide tunnels to include at least +a certain number of hops (plus other criteria that aren't honored yet, such as bandwidth limits, etc). +The decision as to how many routers to have in one's outbound and inbound tunnels has an important +effect upon the latency, throughput, reliabilty, and anonymity provided by I2P - the more peers that +messages have to go through, the longer it takes to get there and the more likely that one of those +routers will fail prematurely. The less routers in a tunnel, the easier it is for an adversary to +mount traffic analysis attacks and pierce someone's anonymity. +

+

0-hop tunnels

+ +

+With no remote routers in a tunnel, the user has very basic plausible deniability (since no one knows +for sure that the peer that sent them the message wasn't simply just forwarding it on as part of the tunnel). +However, it would be fairly easy to mount a statistical analysis attack and notice that messages targetting +a specific destination are always sent through a single gateway. Statistical analysis against outbound 0-hop +tunnels are more complex, but could show similar information (though would be slightly harder to mount) +

+

1-hop tunnels

+ +

+With only one remote router in a tunnel, the user has both plausible deniability and basic anonymity, as long +as they are not up against an internal adversary (as described on I2P/ThreatModel). However, if the adversary +ran a sufficient number of routers such that the single remote router in the tunnel is often one of those +compromised ones, they would be able to mount the above statistical traffic analysis attack. +

+

2-hop (or more) tunnels

+ +

+With two or more remote routers in a tunnel, the costs of mouting the traffic analysis attack increases, since +all remote routers would have to be compromised to mount it. +

+The router will by default use 2-hop tunnels, at least in the main distribution. Prior to the 0.2.5 release, +all tunnels are 1-hop by default. +

+

Tunnel pooling

+ +

+[explain tunnel pools, how we keep a free inbound pool, an outbound pool, and a client inbound pool, and how the +pools are refreshed every minute or so, using the router's default settings] +

+

Tunnel testing

+ +

+All tunnels are periodically tested by their creator by sending a DeliveryStatusMessage? out the tunnel and bound +for another inbound tunnel (testing both tunnels at once). If either fails, both are marked as no longer functional, +and if they were used for a client's inbound tunnel, a new leaseSet is created. Other techniques can be used to test +tunnels later on, such as garlic wrapping a number of tests into cloves, testing individual tunnel participants +seperately (and using the tunnel configuration key to update the next hop to work around failures), etc, but that is +not implemented at the moment. +

+

Tunnel creation

+ +

+Tunnel creation is handled by garlic routing (see I2P/GarlicRouting) a TunnelCreateMessage? to a router, +requesting that they participate in the tunnel (providing them with all of the appropriate information, as above, +along with a certificate, which right now is a 'null' cert, but will support hashcash or other non-free certificates +when necessary). The message also includes a SourceRouteReplyBlock?, which allows the router to encrypt their +TunnelCreateStatusMessage? into a SourceRouteReplyMessage?, which is sent to another router (specified in the +SourceRouteReplyBlock?), who then decrypts the rest of the SourceRouteReplyBlock?, reads out the delivery instructions +contained therein, and forwards the TunnelCreateStatusMessage? accordingly. (the delivery instructions can specify +delivery to a specific router or can point at a tunnel) + +

+

Issues

+ +

+