Tor and I2P

Tor and I2P are anonymity networks that use layered encryption and multi-hop routing to protect user privacy. They represent the most mature implementations of anonymous communication.

Tor (The Onion Router)

Circuit Construction

A Tor client builds a circuit of three relays: guard (entry), middle, and exit.

Each relay peels one layer of encryption (onion layers), learning only its predecessor and successor.

Circuit construction uses a telescoping key exchange: the client negotiates keys with each relay incrementally.

Guard nodes are persistent (used for weeks/months) to limit the adversary's chance of controlling the entry point.

Onion Services (Hidden Services)

A service publishes its descriptor (including introduction points) to a distributed hash table.

Clients use rendezvous points to connect without either party revealing their IP.

Both client and service build circuits to the rendezvous point, achieving mutual anonymity.

v3 onion addresses are 56 characters, encoding an Ed25519 public key.

Tor's Threat Model

Tor protects against local network observers and individual compromised relays.

It is vulnerable to global passive adversaries who can correlate traffic timing at both entry and exit. See Security Threats.

Tor does not protect against application-level leaks (e.g., DNS, browser fingerprinting).

I2P (Invisible Internet Project)

Garlic Routing

I2P bundles multiple messages into encrypted "cloves" and sends them through unidirectional tunnels.

Separate inbound and outbound tunnels add path diversity.

Tunnels are rebuilt periodically (every 10 minutes) for forward secrecy.

Network Design

Every I2P node is a router, distributing load across the network (unlike Tor where relays are opt-in).

Designed for internal services (eepsites, I2P torrents) rather than exit to the clearnet.

Network database (netDB): a Kademlia-like DHT for distributing router info and service lease sets.

Tor vs I2P

Tor optimizes for exit traffic (browsing the clearnet anonymously) and has a larger, more researched network. 3-hop circuits provide reasonable latency.

I2P optimizes for internal services with unidirectional tunnels and universal participation. Higher latency but more resistant to certain traffic analysis attacks.

Both use layered encryption; Tor uses bidirectional circuits while I2P uses separate inbound/outbound tunnels.

Using Tor/I2P with P2P Systems

Several P2P systems can run over Tor or I2P for enhanced privacy:

BitTorrent over I2P (I2PSnark) for anonymous file sharing.

IPFS gateway access via Tor for anonymous content retrieval.

Matrix homeservers accessible as .onion services.

However, running DHT protocols over Tor is challenging due to latency and the need for many connections.

How Tor/I2P Connects to Everything Else

Tor and I2P implement the privacy techniques described in Privacy and Anonymity. They wrap Transport connections in encryption layers. Identity in these networks is pseudonymous by design. Compliance considerations are acute: these tools serve both human rights defenders and those who would abuse them. Exit relay operators face particular legal exposure. Security research on traffic correlation directly impacts Tor's design choices. Testing of anonymity networks requires specialized simulation tools (Shadow simulator).