DOCSLIB.ORG

A Survey on Routing in Anonymous Communication Protocols

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

A Survey on Routing in Anonymous Communication Protocols Fatemeh Shirazi Milivoj Simeonovski Muhammad Rizwan Asghar KU Leuven CISPA, Saarland University Department of Computer Science ESAT/COSIC and iMinds Saarland Informatics Campus The University of Auckland Michael Backes Claudia Diaz CISPA, Saarland University & MPI-SWS KU Leuven Saarland Informatics Campus ESAT/COSIC and iMinds Abstract—The Internet has undergone dramatic changes of this transformation, the mass reach of the Internet has in the past 15 years, and now forms a global communication created new powerful threats to online privacy. platform that billions of users rely on for their daily ac- tivities. While this transformation has brought tremendous The widespread dissemination of personal informa- benefits to society, it has also created new threats to online tion that we witness today in social media platforms privacy, ranging from profiling of users for monetizing and applications is certainly a source of concern. The personal information to nearly omnipotent governmental disclosure of potentially sensitive data, however, not surveillance. As a result, public interest in systems for only happens when people deliberately post content anonymous communication has drastically increased. Several online, but also inadvertently by merely engaging in any such systems have been proposed in the literature, each sort of online activities. This inadvertent data disclosure of which offers anonymity guarantees in different scenarios and under different assumptions, reflecting the plurality of is particularly worrisome because non-expert end-users approaches for how messages can be anonymously routed cannot be expected to understand the dimensions of the to their destination. Understanding this space of competing collection taking place and its corresponding privacy approaches with their different guarantees and assumptions implications. is vital for users to understand the consequences of different design options. Widely deployed communication protocols only pro- tect, if at all, the content of conversations, but do not In this work, we survey previous research on designing, conceal from network observers who is communicating developing, and deploying systems for anonymous commu- with whom, when, from where, and for how long. Net- nication. To this end, we provide a taxonomy for clustering work eavesdroppers can silently monitor users’ online all prevalently considered approaches (including Mixnets, behavior and build up comprehensive profiles based DC-nets, onion routing, and DHT-based protocols) with on the aggregation of user communications’ metadata. respect to their unique routing characteristics, deployabil- ity, and performance. This, in particular, encompasses the Today, users are constantly tracked, monitored, and pro- topological structure of the underlying network; the routing filed, both with the intent of monetizing their personal information that has to be made available to the initiator information through targeted advertisements, and by arXiv:1608.05538v1 [cs.CR] 19 Aug 2016 of the conversation; the underlying communication model; nearly omnipotent governmental agencies that rely on and performance-related indicators such as latency and com- the mass collection of metadata for conducting dragnet munication layer. Our taxonomy and comparative assessment surveillance at a planetary scale. provide important insights about the differences between the existing classes of anonymous communication protocols, and Anonymous Communication (AC) systems have been it also helps to clarify the relationship between the routing proposed as a technical countermeasure to mitigate the characteristics of these protocols, and their performance and threats of communications surveillance. The concept of scalability. AC systems was introduced by Chaum [1] in 1981, Keywords—Anonymous Communication; Routing; Privacy. with his proposal for implementing an anonymous email service that aimed at concealing who sent emails to whom. The further development of this concept in the last decades has seen it applied to a variety of problems I. Introduction and scenarios, such as anonymous voting [2], [3], Private Information Retrieval (PIR) [4], censorship-resistance [5], The Internet has evolved from a mere communication [6], anonymous web browsing [7], hidden web ser- network used by millions of users to a global platform vices [8], and many others. for social networking, communication, education, enter- tainment, trade, and political activism used by billions Public interest in AC systems has strikingly increased of users. In addition to the indisputable societal benefits in the last few years. This could be explained as a response to recently revealed dragnet surveillance pro- A. Routing Characteristics grams, the fact that deployed AC networks seem to become (according to leaked documents1) a major hurdle Generally, routing in a communication network refers for communications surveillance, and to somewhat in- to the selection of nodes for relaying communication creased public awareness on the threats to privacy posed through the network. Routing schemes, however, re- by modern information and communication technolo- quire some essential design components. For anonymous gies. communication, we consider four building blocks that are relevant to routing in AC networks. These building The literature offers a broad variety of proposals for blocks are node management, transfer/retrieval of node anonymity network designs. Several of these designs information to/by the routing decision maker, path selec- have been implemented, and some are successfully de- tion, and forwarding or relaying; where path selection is ployed in the wild. Of the deployed systems, the most the main design component of routing schemes for AC successful example to date is the Tor network, which is protocols. used daily by about two million people [9]. Several taxonomies and classifications for routing Existing designs take a variety of approaches to protocols have been proposed in the literature [19]–[21]. anonymous routing for implementing the AC network. However, AC networks aim to conceal the metadata of Routing determines how data is sent through the net- communications and thus have security requirements work, and it as such constitutes the central element of the that make them fundamentally different from other net- AC design, determining to a large extent both security works. and performance of the system. These approaches rely In this section, we present a classification for anony- on different threat models and sets of assumptions, and mous routing protocols. Our classification (see Tables II they provide different guarantees to their users. Even and III) is an adaptation from Feeney’s taxonomy [20], though survey articles on AC systems exist [10]–[18], we which classifies the routing characteristics of mobile ad still lack a systematic understanding, classification, and hoc networks into four categories: comparison of the routing characteristics of the plurality of existing AC approaches. 1) Communication model describes whether the com- The purpose of this survey is to provide a detailed munication is based on single-channels or multi- overview of the routing characteristics of current AC channels. systems, and to examine how their features determine 2) Structure describes whether or not nodes are treated the anonymity guarantees offered by those systems, as equally. well as its overall performance. To this end, we first 3) State information describes where the topology infor- identify the routing characteristics that are relevant for mation is maintained. AC protocols and provide a taxonomy for clustering 4) Scheduling describes whether the information about the systems with respect to their routing characteristics, routes is maintained at the source or is instead deployability, and performance. Then, we apply the tax- computed on-demand. onomy to the extensive scope of existing AC systems, This taxonomy does not address several relevant in particular including Mixnets, DC-nets, onion routing design features of AC networks, such as probabilistic systems, and DHT-based protocols. Finally, we discuss node selection for constructing circuits, and security the relationship between the different routing decisions, considerations for protecting routing information from and how they affect performance and scalability. different network adversaries. In addition, not all the characteristics identified by Feeney are relevant to AC Outline. Section II provides our taxonomy for anony- routing. For example, the distinction between single- mous routing and describes the various routing features and multi-channel features is not relevant in overlay and dimensions that we are considering for our eval- networks, which constitutes a standard design choice for uation. Section III gives a compact tabular overview many AC networks. describing the classification of existing systems in our taxonomy and reviews existing AC systems with respect We redefine Feeney’s criteria to account for design to their routing characteristics, substantiating the com- choices that are relevant to anonymous routing protocols. pact overview provided in the previous section. Section We distinguish three groups of features inspired by IV discusses the relationship between routing decisions Feeney’s categories: network structure, routing information, and security and anonymity goals, and shares some and communication model: lessons learned. Section V concludes the paper. 1)
Recommended publications
  • Copyrighted Material

    Copyrighted Material

    Anonymizing 1 Your Activities In our daily lives we like to have a certain level of privacy. We have curtains on our win- dows, doors for our offices, and even special screen protectors for computers to keep out prying eyes. This idea of wanting privacy also extends to the use of the Internet. We do not want people knowing what we typed in Google, what we said in our Instant Message conversations, or what websites we visited. Unfortunately, your private information is largely available if someone is watching. When doing any number of things on the Internet, there are plenty of reasons you might want to go incognito. However, that does not mean you’re doing anything wrong or illegal. he justification for anonymity when researching malware and bad guys is pretty Tstraightforward. You do not want information to show up in logs and other records that might tie back to you or your organization. For example, let’s say you work at a finan- cial firm and you recently detected that a banking trojan infected several of your systems. You collected malicious domain names, IP addresses, and other data related to the malware. The next steps you take in your research may lead you to websites owned by the criminals. As a result, if you are not taking precautions to stay anonymous, your IP address will show up in various logs and be visible to miscreants. If the criminals can identify you or the organization from which you conduct your research, they may COPYRIGHTEDchange tactics or go into hiding, MATERIAL thus spoiling your investigation.
  • IPFS and Friends: a Qualitative Comparison of Next Generation Peer-To-Peer Data Networks Erik Daniel and Florian Tschorsch

    IPFS and Friends: a Qualitative Comparison of Next Generation Peer-To-Peer Data Networks Erik Daniel and Florian Tschorsch

    1 IPFS and Friends: A Qualitative Comparison of Next Generation Peer-to-Peer Data Networks Erik Daniel and Florian Tschorsch Abstract—Decentralized, distributed storage offers a way to types of files [1]. Napster and Gnutella marked the beginning reduce the impact of data silos as often fostered by centralized and were followed by many other P2P networks focusing on cloud storage. While the intentions of this trend are not new, the specialized application areas or novel network structures. For topic gained traction due to technological advancements, most notably blockchain networks. As a consequence, we observe that example, Freenet [2] realizes anonymous storage and retrieval. a new generation of peer-to-peer data networks emerges. In this Chord [3], CAN [4], and Pastry [5] provide protocols to survey paper, we therefore provide a technical overview of the maintain a structured overlay network topology. In particular, next generation data networks. We use select data networks to BitTorrent [6] received a lot of attention from both users and introduce general concepts and to emphasize new developments. the research community. BitTorrent introduced an incentive Specifically, we provide a deeper outline of the Interplanetary File System and a general overview of Swarm, the Hypercore Pro- mechanism to achieve Pareto efficiency, trying to improve tocol, SAFE, Storj, and Arweave. We identify common building network utilization achieving a higher level of robustness. We blocks and provide a qualitative comparison. From the overview, consider networks such as Napster, Gnutella, Freenet, BitTor- we derive future challenges and research goals concerning data rent, and many more as first generation P2P data networks, networks.
  • Privacy Enhancing Technologies 2003 an Analysis of Gnunet And

    Privacy Enhancing Technologies 2003 an Analysis of Gnunet And

    Privacy Enhancing Technologies 2003 An Analysis of GNUnet and the Implications for Anonymous, Censorship-Resistant Networks Dennis Kügler Federal Office for Information Security, Germany [email protected] 1 Anonymous, Censorship-Resistant Networks • Anonymous Peer-to-Peer Networks – Gnutella • Searching is relatively anonymous • Downloading is not anonymous • Censorship-Resistant Networks – Eternity Service • Distributed storage medium • Attack resistant • Anonymous, Censorship-Resistant Networks – Freenet – GNUnet 2 GNUnet: Obfuscated, Distributed Filesystem Content Hash Key: [H(B),H(E (B))] • H(B) – Content encryption: H(B) – Unambiguous filename: H(E (B)) H(B) • Content replication – Caching while delivering – Based on unambiguous filename • Searchability – Keywords 3 GNUnet: Peer-to-Peer MIX Network • Initiating node – Downloads content • Supplying nodes – Store content unencrypted • Intermediary nodes – Forward and cache encrypted content – Plausible deniability due to encryption • Economic model – Based on credit Query A Priority=20 B – Charge for queries c =c -20 B B - – Pay for responses 4 GNUnet Encoding • DBlocks DBlock DBlock ... DBlock – 1KB of the content – Content hash encrypted • IBlocks IBlock ... IBlock – CHKs of 25 DBlocks – Organized as tree – Content hash encrypted IBlock • RBlock – Description of the content – CHK of the root IBlock RBlock – Keyword encrypted 5 The Attacker Model • Attacker – Controls malicious nodes that behave correctly – Prepares dictionary of interesting keywords – Observes queries and
  • CS505: Distributed Systems

    CS505: Distributed Systems

    Cristina Nita-Rotaru CS505: Distributed Systems Lookup services. Chord. CAN. Pastry. Kademlia. Required Reading } I. Stoica, R. Morris, D. Karger, M. F. Kaashoek, H. Balakrishnan, Chord: A Scalable Peer-to-peer Lookup Service for Internet Applications, SIGCOMM 2001. } A Scalable Content-Addressable Network S.a Ratnasamy, P. Francis, M. Handley, R. Karp, S. Shenker, SIGCOMM 2001 } A. Rowstron and P. Druschel. "Pastry: Scalable, decentralized object location and routing for large-scale peer-to-peer systems". IFIP/ACM International Conference on Distributed Systems Platforms (Middleware), 2001 } Kademlia: A Peer-to-peer Information System Based on the XOR Metric. P. Maymounkov and D. Mazieres, IPTPS '02 2 DHTs 1: Lookup services Peer-to-Peer (P2P) Systems } Applications that take advantage of resources (storage, cycles, content, human presence) available at the edges of the Internet. } Characteristics: } System consists of clients connected through Internet and acting as peers } System is designed to work in the presence of variable connectivity } Nodes at the edges of the network have significant autonomy; no centralized control } Nodes are symmetric in function 4 DHTs Benefits of P2P and Applications } High capacity: all clients provide resources (bandwidth, storage space, and computing power). The capacity of the system increases as more nodes become part of the system. } Increased reliability: achieved by replicating data over multiple peers, and by enabling peers to find the data without relying on a centralized index server. } Applications:
  • Practical Anonymous Networking?

    Practical Anonymous Networking?

    gap – practical anonymous networking? Krista Bennett Christian Grothoff S3 lab and CERIAS, Department of Computer Sciences, Purdue University [email protected], [email protected] http://www.gnu.org/software/GNUnet/ Abstract. This paper describes how anonymity is achieved in gnunet, a framework for anonymous distributed and secure networking. The main focus of this work is gap, a simple protocol for anonymous transfer of data which can achieve better anonymity guarantees than many traditional indirection schemes and is additionally more efficient. gap is based on a new perspective on how to achieve anonymity. Based on this new perspective it is possible to relax the requirements stated in traditional indirection schemes, allowing individual nodes to balance anonymity with efficiency according to their specific needs. 1 Introduction In this paper, we present the anonymity aspect of gnunet, a framework for secure peer-to-peer networking. The gnunet framework provides peer discovery, link encryption and message-batching. At present, gnunet’s primary application is anonymous file-sharing. The anonymous file-sharing application uses a content encoding scheme that breaks files into 1k blocks as described in [1]. The 1k blocks are transmitted using gnunet’s anonymity protocol, gap. This paper describes gap and how it attempts to achieve privacy and scalability in an environment with malicious peers and actively participating adversaries. The gnunet core API offers node discovery, authentication and encryption services. All communication between nodes in the network is confidential; no host outside the network can observe the actual contents of the data that flows through the network. Even the type of the data cannot be observed, as all packets are padded to have identical size.
  • Mixminion: Design of a Type III Anonymous Remailer Protocol

    Mixminion: Design of a Type III Anonymous Remailer Protocol

    Mixminion: Design of a Type III Anonymous Remailer Protocol G. Danezis, R. Dingledine, N. Mathewson IEEE S&P 2003 Presented by B. Choi in cs6461 Computer Science Michigan Tech Motivation ● Anonymous email only – High latency vs. near real-time (onion routing) ● Anonymous email implementations – Type 1: Cypherpunk (80’s) ● vulnerable to replay attacks – Type 2: Mixmaster(92) ● message padding and pooling – Type 3: Mixminion (2003) ● Anonymous Replies! Reply block? ● Most or many systems support sender anonymity ● Pynchon Gate supports receiver anonymity in an interesting way (P2P file sharing: 2005) – Send everything to everywhere (everyone) ● Is receiver anonymity too hard to achieve? – First of all, receiver has to use pseudonyms ● Pseudonym policy: how many, valid period, ... Reply blocks ● Chaum(‘81), BABEL (‘96), Mixmaster (92) .. – Entire path is chosen by the sender ● Variations are possible ● BABEL RPI is invisible to passive external attackers ● BABEL RPI is visible to internal passive attackers (mix) – Can be used multiple times? ● Good for communication efficiency ● Bad for anonymity due to potential path information leaking ● Adversary could utilize the pattern of the same reply block Fundamental solution to the reply block problem? ● One way is to use single-use reply blocks (SURB) ● Reply messages are indistinguishable from forward messages even to mix nodes ● Effect: both reply and forward messages share the same anonymity set ● SURB ● How to design SURB? – Sender generates SURB – To defeat replay, each intermediate node
  • The Design, Implementation and Operation of an Email Pseudonym Server

    The Design, Implementation and Operation of an Email Pseudonym Server

    The Design, Implementation and Operation of an Email Pseudonym Server David Mazieres` and M. Frans Kaashoek MIT Laboratory for Computer Science 545 Technology Square, Cambridge MA 02139 Abstract Attacks on servers that provide anonymity generally fall into two categories: attempts to expose anonymous users and attempts to silence them. Much existing work concentrates on withstanding the former, but the threat of the latter is equally real. One particularly effective attack against anonymous servers is to abuse them and stir up enough trouble that they must shut down. This paper describes the design, implementation, and operation of nym.alias.net, a server providing untraceable email aliases. We enumerate many kinds of abuse the system has weath- ered during two years of operation, and explain the measures we enacted in response. From our experiences, we distill several principles by which one can protect anonymous servers from similar attacks. 1 Introduction Anonymous on-line speech serves many purposes ranging from fighting oppressive government censorship to giving university professors feedback on teaching. Of course, the availability of anonymous speech also leads to many forms of abuse, including harassment, mail bombing and even bulk emailing. Servers providing anonymity are particularly vulnerable to flooding and denial-of-service attacks. Concerns for the privacy of legitimate users make it impractical to keep usage logs. Even with logs, the very design of an anonymous service generally makes it difficult to track down attackers. Worse yet, attempts to block problematic messages with manually-tuned filters can easily evolve into censorship—people unhappy with anonymous users will purposefully abuse a server if by doing so they can get legitimate messages filtered.
  • Privacy-Enhancing Technologies for the Internet

    Privacy-Enhancing Technologies for the Internet

    Privacy-enhancing technologies for the Internet Ian Goldberg David Wagner Eric Brewer University of California, Berkeley iang,daw,brewer ¡ @cs.berkeley.edu Abstract ing privacy issues on the Internet, and Section 3 provides some relevant background. We then discuss Internet pri- The increased use of the Internet for everyday activi- vacy technology chronologically, in three parts: Section 4 ties is bringing new threats to personal privacy. This pa- describes the technology of yesterday, Section 5 explains per gives an overview of existing and potential privacy- today’s technology, and Section 6 explores the technology enhancing technologies for the Internet, as well as moti- of tomorrow. Finally, we conclude in Section 7. vation and challenges for future work in this field. 2. Motivation 1. Introduction The threats to one’s privacy on the Internet are two-fold: your online actions could be (1) monitored by unauthorized Recently the Internet has seen tremendous growth, with parties and (2) logged and preserved for future access many the ranks of new users swelling at ever-increasing rates. years later. You might not realize that your personal infor- This expansion has catapulted it from the realm of academic mation has been monitored, logged, and subsequently dis- research towards new-found mainstream acceptance and in- closed; those who would compromise your privacy have no creased social relevance for the everyday individual. Yet incentive to warn you. this suddenly increased reliance on the Internet has the po- The threat of long-term storage and eventual disclosure tential to erode personal privacies we once took for granted. of personal information is especially acute on the Internet.
  • A Concept of an Anonymous Direct P2P Distribution Overlay System

    A Concept of an Anonymous Direct P2P Distribution Overlay System

    22nd International Conference on Advanced Information Networking and Applications A Concept of an Anonymous Direct P2P Distribution Overlay System Igor Margasiński, Michał Pióro Institute of Telecommunications, Warsaw University of Technology {I.Margasinski, M.Pioro}@tele.pw.edu.pl Abstract an anonymous network composed of nodes called Mixes that forward anonymous messages. The strength The paper introduces a peer-to-peer system called of the solution consists in: (i) a specific operation of P2PRIV (peer-to-peer direct and anonymous nodes which “mixes” forwarded messages, and (ii) an distribution overlay). Basic novel features of P2PRIV asymmetric encryption of messages exchanged are: (i) a peer-to-peer parallel content exchange between them. The purpose of such mixing is to hide architecture, and (ii) separation of the anonymization the correlation between received and forwarded process from the transport function. These features messages. In general, received data units are padded to allow a considerable saving of service time while a constant size length, encrypted, delayed for a batch preserving high degree of anonymity. In the paper we aggregation and then sent (flushed) in a random order. evaluate anonymity measures of P2PRIV (using a Anonymous messages are sent usually via a chain of normalized entropy measurement model) as well as its Mixes to eliminate presence of a trusted party and also traffic measures (including service time and network to omit single point of failure imposed by a single Mix. dynamics), and compare anonymity and traffic In Mix-net, each message is encrypted recursively with performance of P2PRIV with a well known system public keys of Mixes from a forwarding path.
  • Conditional Pseudonymity in Vehicular Ad Hoc Networks

    Conditional Pseudonymity in Vehicular Ad Hoc Networks

    Diplom Thesis Faculty of Engineering and Computer Science Ulm University Conditional Pseudonymity in Vehicular Ad Hoc Networks Florian Marcus Schaub presented on November 13, 2008 Supervisors Prof. Dr.-Ing. Michael Weber Dr. Frank Kargl Advisor Zhendong Ma Faculty of Engineering and Computer Science, Ulm University James-Franck-Ring, 89081 Ulm, Germany This thesis has been prepared in the summer semester 2008 as a requirement for the completion of the Diplom course Medieninformatik at Ulm University. Cover photo: Night blur by Mando Gomez http://www.mandolux.com Printed on November 9, 2008. Some rights reserved. This work is licensed under the Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 Germany License. To view a copy of this license, visit http://creativecommons.org/ licenses/by-nc-nd/3.0/de/ or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA. Computer Science is no more about computers than astronomy is about telescopes. Edsger W. Dijkstra Contents 1 Introduction 1 2 Problem Analysis 5 2.1 Characteristics of Vehicular Ad Hoc Networks . 5 2.2 Security and Privacy in Vehicular Ad Hoc Networks . 9 2.3 Conditional Pseudonymity . 14 2.4 Summary . 18 3 Requirements for Privacy in VANETs 19 3.1 Assumptions . 20 3.2 General VANET Requirements . 21 3.3 Pseudonym Requirements . 23 3.4 Authentication Requirements . 28 3.5 Summary . 30 4 Privacy in other Domains 33 4.1 Health Care . 34 4.2 E-Government . 39 4.3 E-Commerce . 43 4.4 Internet . 51 4.5 Ad Hoc Networks . 59 4.6 Summary .
  • Social Network Based Anonymous Communication in Tor Peng Zhou, Xiapu Luo, Ang Chen, and Rocky K

    Social Network Based Anonymous Communication in Tor Peng Zhou, Xiapu Luo, Ang Chen, and Rocky K

    1 STor: Social Network based Anonymous Communication in Tor Peng Zhou, Xiapu Luo, Ang Chen, and Rocky K. C. Chang Department of Computing, The Hong Kong Polytechnic University, Hunghom, Hong Kong cspzhouroc,csxluo,csachen,csrchang @comp.polyu.edu.hk f g Abstract—Anonymity networks hide user identities with the help of relayed anonymity routers. However, the state-of-the-art anonymity networks do not provide an effective trust model. As a result, users cannot circumvent malicious or vulnerable routers, thus making them susceptible to malicious router based attacks (e.g., correlation attacks). In this paper, we propose a novel social network based trust model to help anonymity networks circumvent malicious routers and obtain secure anonymity. In particular, we design an input independent fuzzy model to determine trust relationships between friends based on qualitative and quantitative social attributes, both of which can be readily obtained from existing social networks. Moreover, we design an algorithm for propagating trust over an anonymity network. We integrate these two elements in STor, a novel social network based Tor. We have implemented STor by modifying the Tor’s source code and conducted experiments on PlanetLab to evaluate the effectiveness of STor. Both simulation and PlanetLab experiment results have demonstrated that STor can achieve secure anonymity by establishing trust-based circuits in a distributed way. Although the design of STor is based on Tor network, the social network based trust model can be adopted by other anonymity networks. Index Terms—Social Network, Anonymous Communication, Tor, Fuzzy Model F 1 INTRODUCTION alone can be easily bypassed by an attacker.
  • Analysis of the I2P Network

    Analysis of the I2P Network

    Analysis of the I2P Network Degree programme: BSc in Computer Science | Specialisation: IT-Security Thesis advisor: Prof. Dr. Emmanuel Benoist Expert: Daniel Voisard (BAKOM) Providing anonymous online communication is challenging and an 1 important task. Similar to the well-known and -researched TOR project, I2P (Invisible Internet Project) aims to provide this inside its own network. But how secure and protected can a user feel when using I2P? The main objectives of this thesis were to create I2P Observer, a Java program which gathers and publishes information about the I2P network, and to evaluate possible attacks on the software. The I2P Network view pages with accurate data and monthly ones I2P aims to provide anonymous communication bet- where the average for each day is computed. I2P ween participating systems inside an overlay network, Observer is also easily configurable to collect more separated from other Internet traffic. It is written in and more accurate data. Java with versions for Windows, Linux and Mac, pro- viding HTTP- and HTTPS-Proxies for browsing and Theoretical Attacks on I2P APIs to adapt applications to communicate over I2P. The main motivation for this thesis was an evaluation Multiple layers of strong cryptography are used to pro- of I2P’s security, which was researched with 4 dif- tect the content of packets and a mechanism called ferent approaches: Garlic Routing, where multiple messages for the same − Impersonation of a service: Can a user be redirec- destination can be encapsulated, to hide meta data. ted to a malicious server without noticing it? Jens Henning Müller Its NetDB, a database distributed across participating A Clickjacking attack which allows this under cer- [email protected] peers – so called floodfil routers – contains all infor- tain circumstances was found.