Dark Web, Deep Web, and I2P Dante Taylor, Dayton Chamberlin, Kade Randall, Trevor, Tanner, Harshit Joshi, Troy

The component of world wide web(www): Surface Web Deep Web Dark Web Dickson, Ben. “A Beginners Guide to the Dark Web.” The daily Dot, 19 July 2017, www.dailydot.com/layer8/what-is-dark-web./.

Deep Web: as known as ‘Invisible Web’ What is Deep Web? Part of the Internet that is hidden from view 96% of content that cannot be search by any engines Who use it? How to access it? R. (2018, April 08). Everything You Need to Know on Tor & the Deep Web. Retrieved April 20, 2018, from https://www.whoishostingthis.com/blog/2017/03/07/tor-deep-web/

Dark Web : Hidden content that require special software to access Who used the dark web? Bad or Good Guy? How to access the dark web? Tor browser

Difference between the Dark web and the Deep web :

The tools used to access the different parts of the internet:

Onion Routing (overview) Encrypted messages over the Internet can be tracked (traffic analysis) Onion routing provides bi-directional and near real-time communication similar to TCP/IP socket connections or ATM AAL5 Onion routing network allows connection between initiator and responder to remain anonymous Onion routers are connected in the network by longstanding socket connections Anonymous connections through the network are multiplexed over the longstanding connections Sequence of routers in a route is predefined at setup M. G. Reed, P. F. Syverson, & D. M. Goldschlag (1998, May). Anonymous connections and onion routing. Retrieved from https://www.onion-router.net/Publications/JSAC-1998.pdf

Onion Routing (overview) cont. Each onion router can only identify the previous and the next hops along a route Data passed along the anonymous connection appears different at each onion router, so data cannot be tracked Although, this system is called onion routing, the routing that occurs here happens at the Application layer of the protocol stack not at the IP layer. More specifically, we rely on IP routing to route data passed through the longstanding socket connections. The route that data actually travels between individual onion routers is predetermined by underlying IP network similar to loose source routing (LSR). Onion routing can easily be layered on top of other connection based services, like ATM AAL5. M. G. Reed, P. F. Syverson, & D. M. Goldschlag (1998, May). Anonymous connections and onion routing. Retrieved from https://www.onion-router.net/Publications/JSAC-1998.pdf

Phases in Onion Routing system There are four phases in an onion routing system: Network setup, which establishes the longstanding connection between onion routers Connection setup, which establishes anonymous connections through the onion router network Data movement over an anonymous connection and, Destruction and cleanup of anonymous connections M. G. Reed, P. F. Syverson, & D. M. Goldschlag (1998, May). Anonymous connections and onion routing. Retrieved from https://www.onion-router.net/Publications/JSAC-1998.pdf

Operation of Onion Routing The Onion routing network is accessed via a series of proxies Initiating application makes a socket connection to an application proxy Proxy manipulates connection message format to a generic form that can be passed through the network Next, it connects to an onion proxy that defines route through the onion routing network by construction of an “onion” The onion is passed to the entry funnel (entry point) which occupies one of the long standing connections to the onion routing network at that onion router Each layer of the onion defines the next hop in a route An onion router that receives an onion “peels off” its layer, identifies the next hop and sends the embedded onion to that onion router The last onion router forwards data to an exit funnel (exit point), whose job is to pass data between the onion routing network and the responder M. G. Reed, P. F. Syverson, & D. M. Goldschlag (1998, May). Anonymous connections and onion routing. Retrieved from https://www.onion-router.net/Publications/JSAC-1998.pdf

Structure of each onion layer The first bit is always must be zero for RSA public key cryptography to succeed. Version: Version Number of the Onion routing system, currently defined to 1. Back F: It denotes the cryptographic function to be applied to data moving in backward direction using key2 (direction opposite in which the onion travelled usually towards the initiator’s end) Forw F: It denotes the cryptographic function to be applied to data moving in the forward direction using key3 (direction as that which the onion travelled usually towards the responder’s end) Defined cryptographic functions are: 0 for Identity (no encryption), 1 for DES OFB (output feedback mode) (56 bit key), and 2 for RC4 (128 bit key). Destination Port and Destination address: Indicate the next onion router in the network order and are both 0 for the exit funnel. Expiration Time: Specifies how long the onion router at this hop in the anonymous connection must track the onion against replays before it expires. Given in network order in seconds relative to 00:00:00 UTC January 1, 1970 (standard UNIX time(2) format) Key Seed Material: It is 128 bits long and is hashed three times with SHA to produce three cryptographic keys (key1, key2, key3) of 128-bits each

Implementation of Onion Routing: Tor (Taken from website overview) - The Tor network is a group of volunteer-operated servers that allows people to improve their privacy and security on the Internet. Tor's users employ this network by connecting through a series of virtual tunnels rather than making a direct connection, thus allowing both organizations and individuals to share information over public networks without compromising their privacy. Along the same line, Tor is an effective censorship circumvention tool, allowing its users to reach otherwise blocked destinations or content. Tor can also be used as a building block for software developers to create new communication tools with built-in privacy features. Tor. (n.d). Retrieved from https://www.torproject.org/

How Tor Works: Tor. (n.d). Retrieved from https://www.torproject.org/

Application and vulnerabilities Though onion routing seems secure, there has been difficulties with the implementation of it. One of the most famous examples of onion routing is the browser Tor which allows you to view the dark web anonymously. Tor has had many leaks over the years due to it being the popular choice. Just last year, one of Tor’s leaks were published where it would leak the IP of the user to whoever wished to view it. This was leak was only on Linux and Mac ,but it shows how this field of technology is still under development. Even with 100% implementation of onion routing, there still would be vulnerabilities in their systems. For instance with the right equipment and tracking, someone could view your entry node, website your visiting, and exit node if they correlated all the traffic together. Basically you send into the node 10 mb of encrypted data and the website sends back 10 mb of encrypted data they know it’s you who are connected. This method is also called a traffic confirmation attack which can’t be avoided. A. (2014, July 30). Tor security advisory: "relay early" traffic confirmation attack. Retrieved from https://blog.torproject.org/tor-security-advisory-relay-early-traffic-confirmation-attack

A screencap of the web browser-based router console I2P An anonymous network layer designed to be accessed through a web browser-based router console Supplementary tool for other software to make direct, encrypted connections between two specific clients I2P is message based (similar to IP), however it also includes a library to allow reliable streaming A screencap of the web browser-based router console

I2P (cont.) I2P is compatible with software to serve many different purposes: General Networking - I2PTunnel (arbitrary TCP/IP applications can communicate), SAM [Simple Anonymous Messaging], BOB [Basic Open Bridge] (similar to I2PTunnel) Chat - Any IRC (Internet Relay Chat) client works on the I2P IRC server (on localhost) File Sharing - I2PSnark, BiglyBT, I2P-BT (BitTorrent - I2P linkups) Email - I2P-Bote, Susimail (pseudonymous, web-based, run by an individual: [Postman]) Routing - I2PBerry (Linux-based), Kovri (Cryptocurrency transaction scrambler) Publishing - Syndie (Content distribution), Aktie (Anon. file sharing/web of trust forums) Instant Messaging - I2P-Messenger and I2P-Talk

I2P - How it works Uses a process called ‘Garlic Routing’ (very similar to onion routing) Unidirectional tunnels (Onion Routing uses bidirectional tunnels) Multiple messages are encrypted together before being bundled, encrypted, and sent off to the destination host Increases the rate of data transfer by encrypting multiple messages together All messages, with individual delivery instructions, are decrypted at the endpoint