After more than two years of development, the release of the reference implementation of the Yggdrasil 0.5 protocol has been published, allowing the deployment of a separate decentralized private IPv6 network over the regular global network for privacy protection, utilizing end-to-end encryption. Any existing applications that support IPv6 can be used within the Yggdrasil network. The implementation is written in Go and is distributed under the LGPLv3 license. Supported platforms include Linux, OpenWRT, Windows, macOS, FreeBSD, OpenBSD, VyOS, and Ubiquiti EdgeRouter.
Yggdrasil develops a new routing concept for creating a global decentralized network, where nodes can connect directly to each other in a mesh network manner (for example, via Wi-Fi or Bluetooth), as well as interact over existing IPv6 or IPv4 networks (network over network). A distinguishing feature of Yggdrasil is its self-organizing operation, which does not require explicit routing setup — route information is calculated based on the node's location in relation to other nodes. Devices are addressed via a standard IPv6 address, which does not change when the node moves (Yggdrasil uses an unused range of addresses 0200::/7).
The entire Yggdrasil network is viewed not as a collection of disparate subnetworks, but as a single structured spanning tree with one "root" where each node has one parent and one or more descendants. This tree-like structure allows for constructing a route to the destination node relative to the source node, using a "locator" mechanism that defines the optimal path to the node from the root. Information about the tree is distributed among the nodes and is not stored centrally.
To protect against traffic analysis, end-to-end encryption is applied in the network (transit nodes cannot determine the content), but anonymity is not guaranteed — when connected via the internet, peer nodes with which direct interaction occurs may determine the real IP address, therefore it is recommended to connect nodes via Tor or I2P for anonymity.
Despite the project being in the alpha development stage, it is already stable enough for daily use, although it does not guarantee backward compatibility between releases. The Yggdrasil community supports a set of services, including a platform for hosting Linux containers for hosting its websites, the YaCy search engine, the Matrix communication server, the IRC server, DNS, a VoIP system, a BitTorrent tracker connection map, a gateway to IPFS, and a proxy for accessing Tor, I2P, and clearnet networks.
In the new version:
- The ability to authenticate connections to peers using a password has been added. The password is set using the parameter "password=", for example, "tls://a.b.c.d:12345?password=123456abcdef."
- Support for the QUIC protocol, based on UDP, has been added for interaction with peers. To use QUIC, the URI scheme quic:// should be specified in the Listen and Peers directives, but QUIC support is not as well-tested as TCP and TLS yet.
- An option called PrivateKeyPath has been added, allowing the storage of the private key in PEM format, separate from the main configuration file. The option "-exportkey" can be used to export the key to a separate file.
- A new routing scheme has been implemented that is not backward compatible with previous versions (nodes running Yggdrasil 0.5 cannot interact with hosts based on Yggdrasil 0.4), but it addresses most of the stability and scalability issues present in branch 0.4 while significantly reducing memory consumption and lowering traffic during periods of network inactivity.
In the new implementation, a probabilistic Bloom Filter structure is used to track relationships and nodes. The distributed hash table (DHT) is no longer used for routing data exchange and binding public keys in the tree network.
To maintain local consistency and reduce dependence on routes to root nodes, nodes now separately send information about each link, which is tracked in CRDT structures. Instead of source-based routing, a greedy algorithm-based routing method is used (requests are directed to the nearest neighboring node).
The formats used for connection negotiations and multicast distribution have been reworked for better scalability. The connection management code has been revamped for more reliable peer status tracking. Separate tracking of intervals between reconnections for each configured peer has been implemented.
To detect failures, acknowledgment-based traffic messages are used instead of periodic isolated keepalive requests, which reduce traffic during network inactivity (thus lowering power consumption on mobile devices by eliminating idle traffic).
Source: opennet.ru
