Hi, everyone. This is I2P, major changes of the peer-to-peer network by Conrad Bechler.
Close enough. Enjoy.
Hello, everyone. Thank you for being here. That's my third I2P talk at FOSSTEM.
First one was about DNS. That was the most difficult for me personally.
And now a major changes of the peer-to-peer network of a bunch of programmers,
which are creating I2P, which is an overlay network.
I'm an independent researchers and software architect and developer,
and I'm developing libraries, and I'm working full-time for Diva.Exchange,
which is a small non-profit association in Switzerland.
And there is nothing like a centralized model involved,
because I'm totally living in the peer-to-peer I2P world,
because I really love what the I2P developers and the open sources space are doing.
Since the last 20 years, and I suggest we're looking now at the agenda.
I'll give you a short introduction of I2P, and then we're looking at what the developers did.
As the latest changes of the code.
And we'll focus, since I'm an application developer based on the I2P network,
what is the impact? We're looking at the summary.
And I understood that there are no questions, so if you have questions,
I'll be outside in the hall for a few minutes,
and I'm happy to get in touch with you if you have critical and skeptical questions.
Short thing, what is the role of Diva.Exchange within I2P?
I2P is a developer team.
Diva.Exchange is a developer team.
And the I2P developers are spread all over the world.
The Diva.Developers are spread all over the world.
We're cooperating friendly, but we're not the same.
Diva.Exchange is primarily a library developer and is supporting
official, so-called official, open-source Docker images.
That's what we're doing.
Myself, since I'm a researcher, I'm cooperating with Swiss universities,
and I'm open for all corporations with any university to take a very skeptical perspective
towards our own work.
Now what is the I2P network?
I2P network is an overlay network.
And now please jump to the very last line of this slide.
I2P gives you privacy by design, serious privacy by design.
It means you get confidentiality and total anonymity.
Just as an example, this statement that the network gives you total anonymity
is something which we do research in Switzerland, whether we can break this anonymity.
And that's one of our research approaches.
But currently, at the current state of knowledge, and since I2P is existing
since 20 years, we can say it's confidential and anonymous.
Now a question.
Whoever in this room, in the past presentations, there was around 5% of the audience
have ever gotten in touch and used I2P in their life.
Please, hands up. Wow, that's close to 20%.
Cool, thank you.
So for the others which do not know it, anonymity has a cost attached.
And this cost is called latency.
So when I'm talking about an anonymous network which gives you full confidentiality,
then these messages are multiple time encrypted and hop from peer to peer to its destination.
And through another tunnel, they hop back, the reply hops back.
And this is giving anonymity on a very, very, very high level.
A word to be clear here.
I2P has no storage capability by itself.
It's a transport layer.
Now how to get I2P?
Those which got in touch with it, they know that.
There are the Linux repos, and then there are PPAs,
and then there are the container maintained by Devo Exchange, which you find on Docker.
Now why is there I2P?
And why is there I2PD?
Because there are two versions available from two development teams.
In short, I2P is written in Java.
It has a user interface.
And there are a lot of fans around there which really like that.
And then there is a smaller version, which is I2PD, which is written in C++,
and which is the demon only, so it's rather a bit more for admins.
Devo uses I2PD, and there's also the image maintainer on Docker for this version.
From my point of view, both are equally valid.
Word of warning, please don't trust any binaries which floating around here and there,
which you can't reproduce locally by yourself, please build it yourself if you can, and sure you can.
Because this gives power to the open-source developers.
So if you just consume some binaries, please don't.
It's also dangerous because you have a router running on your local machine.
The whole thing here is it's a peer-to-peer network without any central authority,
without any trust involved.
Now, the latest changes.
Since 20 years I2P is existing and gets developed,
and there are two transport protocols.
TCP and UDP.
TCP as also used within other overlay networks was a long while,
so around four years already upgraded to so-called NTCP2, which is much modernized,
so the TCP communication was already pretty well done in the last four years.
But UDP, which is something where you just blow out messages to the network,
and I'll talk about that in a minute, which is fast for I2P in an I2P context,
was not modernized since 15 years.
And the developer of I2P, they worked one full year on modernizing UDP,
and they call it SSU2.
So when you hear SSU2 in the context of I2P, it's UDP.
If you want to dig deeper, then please take a look at noiseprotocol.org,
that's very important also for other overlay networks you might have heard of,
and the developer team of I2P has borrowed quite some things from WireGuard,
VPN, and also from Qwik, and there are some RFCs around,
so please dig deeper by using these hints.
Then the cryptography had to be updated too.
There will be more work coming in the upcoming years, I know for sure.
But it's now already on a quite good state.
All right, seven minutes to go.
What were the goals?
UDP, the performance, is simply much better in an overlay network
than TCP.
Me as an application developer, which is creating a fully distributed storage layer
on top of the I2P network,
performance to communicate between the nodes in the I2P network is an issue.
So for me, it was always the choice to take UDP,
and I implemented a gossiping protocol to realize this fully anonymous blockchain,
and so this distributed storage layer,
and I needed UDP that the peers could communicate within each other.
So for me, this was really an important goal that they could improve the performance a lot.
Nationally, as you know, there are countries in this world where communication is not that easy
as we have the luck to be here in Europe,
so obfuscation is a topic.
For all those people, for all the whistleblowers and the journalists
which are using I2P in critical countries,
they must not be detected,
and I2P is one of the premier solutions too
for such people which need communication on a very confidential level.
So the obfuscation was a big topic,
and additionally, again, UDP is easily attackable,
so the developers had to look into the security problems they had,
and they did, and they did a good job.
Right.
There are a few other challenges of UDP, like the fragmentation of messages.
You know, you have a long message, you want to send it through the network,
but it gets chopped up into pieces, and UDP is not reliable,
so the developers really had some challenges to solve in the last 12 months.
But the fact is, they have implemented strong solutions,
and today, if you look at the release notes of I2P,
I2P is in a much better state.
And this is what I want you as a core take out of this presentation.
I2P gives you, since 20 years, real privacy by design,
and the developers did a good job the last 20 years.
But now, with this performance improvement,
and that's my personal view on their work,
they really made a major step forward.
Because UDP is for application developers really important within the I2P network.
That's my personal view on it.
Please feel free to criticize me afterwards in the Q&A session outside
if you see this differently, or if you have a different view on it.
I'm happy to hear that.
But these reductions, they are relevant.
For us as application developers, we directly felt this performance impact.
In November, when the release was, so four months ago,
or three and a half months ago,
the performance in our blockchain test network improved very much.
And although I believe from research point of view,
we have quite some work ahead of us to,
skeptically and very critically looking at the latest changes
to see whether some weird box have been introduced.
The first impression of the two months is,
that's a new generation of I2P.
So for me, the performance impact is really, really relevant.
We're on the target.
We're seeing the target line.
Takeouts.
After 20 years of development, I2P is the leading peer-to-peer privacy by design network
which is a transport layer only,
which gives you today very modern cryptography,
very modern possibilities to use as an application developer.
The performance increased significantly since last November.
And if you feel as a researcher too,
or as an application developer to take a closer look at I2P,
now it's a good time.
Either you can invest as a researcher trying to break the anonymity
and present it at an upcoming conference,
or you try to create some applications on top of it.
I believe currently is a good point to take a look again at I2P
because now it's really quite fast to use and it's also fun to use.
On GitHub, so that's in the lower right corner and you'll find it online on GitHub,
you'll find Docker images which help you to get started with I2P really quickly.
You can, because a peer-to-peer network,
to create it as a test network is quite complex.
But we created here simple images for you which you can start with Docker Compose.
You have all the containers running,
your member of the I2P network and you can write your application on top of this network.
Here is a list of sources.
Please do your own research too
because privacy by design also means that we hope to motivate US developers
to take a look, a very close look at the documentation,
a very close look at the source code to be skeptical
because privacy is such an important topic for us as developers.
So we're always very, very pleased if we get critical feedbacks
on the development of the stuff we're doing.
Thank you very much for your time.
Have a great 4STEM. Thank you.
Thanks, Koran. Really nice talk.
Again, if you have questions, please grab them outside and be happy to answer.
I hope.
Thank you.