Tor is apparently no longer a safe place to run a marketplace for illegal goods and services. With the alleged operator of the original Silk Road marketplace, Ross Ulbricht, now going to trial, the arrest of his alleged successor and a number of others in a joint US-European law enforcement operation, and the seizure of dozens of servers that hosted "hidden services" on the anonymizing network, the operators of the latest iteration of Silk Road have packed their tents and moved to a new territory: the previously low-profile I2P anonymizing network.

The original Silk Road, federal authorities claim, was unmasked by a bug in a Captcha screen. It's not clear how "Operation Onymous" unmasked hidden sites on Tor. Blake Benthall, the man accused of running Silk Road 2.0, was undone by an undercover federal agent who had been hired as part of the marketplace's administrative team. Other sites may have been identified by monitoring of the data centers their servers resided in, data from the compromised Silk Road site, exploits of insecure code in their sites, bad operational security, or through old-fashioned informants (or some combination of all of the above). The Tor service itself remained uncompromised overall, but that was of little comfort to the individuals who have stepped up to hoist the banner of Silk Road yet again.

On the surface, I2P (which originally was an acronym for "Invisible Internet Project") is similar in many ways to the Tor Project's anonymizing service. Like Tor, I2P encapsulates and anonymizes communications over the Internet, passing Web requests and other communications through a series of proxies to conceal the location and identity of the user. Like Tor, I2P also allows for the configuration of websites within the network that are concealed from the Internet at large. Called "eepsites," these equivalents to Tor's hidden services can only be reached by using the anonymizing network or a portal site that connects to the I2P proxy network.

But there are some significant differences between Tor and I2P beneath the surface, from the technologies they are based on to how the networks are implemented. In many ways, I2P is a much less mature technology than Tor—but it has the potential to anonymize a greater range of applications and services as it gains adoption, and its architecture is theoretically less vulnerable to the sorts of de-anonymizing attacks that some researchers have claimed to have been able to use against Tor.

Add some garlic

Both Tor andI2P use encrypted routing to hide the contents of their traffic. Tor is an "onion router" network; it creates channels using a network socket proxy—the Tor client software, which constructs an anonymized route to the destination and adds layers of encryption for each router along the route it must pass through, uses their public keys from a directory. In succession, each layer of encryption is removed as it passes through a router, until it arrives at the destination and is decrypted completely.

By contrast, I2P uses an approach jokingly called "garlic routing" (a term coined by Michael J. Freedman in response to Tor Project co-founder Roger Dingledine's description of onion routing in his 2000 master's thesis at MIT). The message is encrypted with a key for the end-point, and then each router along the path uses an encrypted "tunnel" to add a second layer of protection as it moves to the next—so there's always two layers of encryption on I2P traffic. And bundled in with the packaged "clove" of a message are additional encrypted handling messages: a "delivery status" message giving instructions on sending a message response to provide information on where the response of the message is to be sent and data with the sender's public key and other data needed to route back the response. Additionally, the router can bundle in other messages from other users into the same "garlic" for forwarding, making it more difficult to track an individual message in the stream.

I2P uses the "garlic" approach because I2P is essentially a purely peer-to-peer anonymizing service. All clients on the network also act as routers for I2P traffic, and there is no centralized directory server to help clients pre-build the routes for their connections. This is, in some ways, a blessing: it allows I2P to be a packet-switched network and load balance traffic across peers rather than having all the traffic from one client to an exit point follow a single path (as Tor does). It also allows I2P to use unidirectional tunnels—responses sent back to a request don't follow the same network path, making it more difficult to man-in-the-middle both parts of an I2P communication.

The packet-based, one-way approach to connections also allows I2P to support UDP traffic—which means I2P can support a number of streaming applications. While the throughput of I2P probably isn't enough to support voice over IP or peer-to-peer video chat, the speed of an I2P connection can be increased by applications by trading off anonymity—by reducing the number of hops through routers traffic takes to get to the end destination. The number of hops required can be configured based on the user's risk profile to add greater protection as well, adding more hops to make it more difficult to unmask the user.

Trust no one

Since it's entirely peer-to-peer in structure, there's no hard-coded trusted set of directory stores. Instead, the network directory of I2P is netDb, a distributed database that is replicated across the network. The NetDb is a distributed hash table similar to Kademlia, a peer-to-peer network developed by Petar Maymounkov and David Mazières that was also used by LimeWire to improve the Gnutella file-sharing protocol.

The netDb network database contains information on active routers (peers on the network available for routing traffic) and endpoints, such as "eepsites" and exit points to the public Internet, including their Internet location, the network port number they listen on, and their public encryption keys. An I2P router can be configured to opt in as part of the distributed storage system, called the "Floodstore"; since the database is constantly verified and updated each time a connection is made, there's no inherent trust of the database involved in routing traffic.

While this makes I2P useful for things like anonymized BitTorrent streams and the like, it does not have the scale or the level of additional protections that the Tor network provides. There are no tools to help get around state-imposed firewalls, for example, like Tor's pluggable transports and bridges. But being small has made I2P less of a target for denial-of-service attacks and state blocking so far. That's something that Silk Road Reloaded may change).

There's also not as much in the way of ready-made software and developer support for I2P as there is for Tor. But since I2P is based on Java, it is easily ported to new platforms. And as with Tor, there is a browser bundle available based on Firefox—called Abscond—for those who want a simpler way to hide themselves. (Unfortunately, it's only available for Windows.)

The biggest issue I2P faces is scalability. The network is still very small, which may not be very comforting to those who want to use I2P to hide from law enforcement, since the signature of their traffic will be relatively easy to spot. And just how well I2P will deal with growth is still an unknown, particularly as the complexity of the distributed network database grows and the relative number of routers contributing to the Floodstore decreases with the arrival of more transactionally-oriented users.