-Updated January 2011, current as of router version 0.8.3 +Updated August 2011, current as of router version 0.8.7
This page specifies the low-level details of the cryptography in I2P.
@@ -166,7 +166,7 @@ as a part of ElGamal/AES+SessionTag For encryption of periodic tunnel test messages sent from the router to itself, through its own tunnels.
-We use 256 bit AES in CBC mode. +We use AES with 256 bit keys and 128 bit blocks in CBC mode. The padding used is specified in IETF RFC-2313 (PKCS#5 1.5, section 8.1 (for block type 02)). In this case, padding exists of pseudorandomly generated octets to match 16 byte blocks. Specifically, see @@ -175,14 +175,12 @@ and the Cryptix AES [implementation], as well as the padding, found in the ElGamalAESEngine.getPadding function. + + + +
The vulnerability of the network to an AES attack and the impact of transitioning to a longer bit length is to be studied. @@ -397,6 +398,13 @@ router's DSA key, plus each network message has their own hash for local integri checking.
See the SSU specification for details. +
+WARNING - I2P's HMAC-HD5-128 used in SSU is apparently non-standard. +Apparently, an early version of SSU used HMAC-SHA256, and then it was switched +to MD5-128 for performance reasons, but left the 32-byte buffer size intact. +See HMACGenerator.java and +the 2005-07-05 status notes +for details.