The IETF (Internet Engineering Task Force), which is responsible for the development of Internet protocols and architecture, has initiated the process of standardizing the GNS (GNU Name System) domain name system, which is being developed by the project as a fully decentralized and censorship-resistant replacement for DNS. Currently, the first draft version of the standard, after stabilization, will form an RFC that will hold the status of 'Proposed Standard'.
can be used alongside DNS and utilized in traditional applications such as web browsers. The integrity and immutability of records are ensured through cryptographic mechanisms. Unlike DNS, GNS employs a directed graph instead of a tree hierarchy of servers for name transformations, which is similar to DNS. However, requests and responses maintain privacy — the node processing the request does not know to whom the response is given, and transit nodes and third-party observers cannot decrypt the requests and responses.
A DNS zone in GNS is defined using a pair of open and private keys based on elliptic curves . The use of Curve25519 by some as quite a strange move, as other types of elliptic curves are used for ECDSA, while Curve25519 is typically paired with digital signature algorithms , , more secure, and faster than ECDSA. From a cryptographic resilience standpoint, the choice of key size — 32 bytes instead of the usual 64 bytes for Ed25519 — also raises questions, as does the use of symmetric encryption, using AES and TwoFish algorithms in CFB mode.
This approach is explained by the need to implement hierarchical keys, allowing the use of a root public key to derive a child public key, utilizing the linearity property of the Curve25519 curve. This feature enables the generation of child public keys without knowing the private root keys. The specified technique is also used in Bitcoin. The 32-byte key size is selected to ensure that the key fits in a single DNS record.
Additionally, it can be noted framework , designed for building secure decentralized P2P networks. Networks created using GNUnet have no single point of failure and can guarantee users' privacy, including eliminating potential abuses by intelligence agencies and administrators who have access to the network nodes. This release is marked by significant protocol changes that violate backward compatibility with versions 0.12.x.
GNUnet supports the creation of P2P networks over TCP, UDP, HTTP/HTTPS, Bluetooth, and WLAN, and can operate in F2F (Friend-to-friend) mode. NAT traversal is supported, including using UPnP and ICMP. For addressing data storage, a Distributed Hash Table (DHT) can be used. Tools for deploying mesh networks are provided. For selective access grant and revocation, the decentralized attribute exchange service , GNS (GNU Name System) and attribute-based encryption ().
The system features low resource consumption and a multi-processing architecture to ensure isolation between components. Flexible tools for logging and accumulating statistics are provided. For developing end applications, GNUnet offers an API for the C language and bindings for other programming languages. To simplify development, it is recommended to use event loops and processes instead of threads. It includes a testing library for the automatic deployment of experimental networks covering tens of thousands of peers.
In addition to GNS, several ready-to-use applications based on GNUnet technologies are also being developed:
- A service for anonymous file sharing that prevents information analysis by transmitting data solely in encrypted form and does not allow tracking of who uploaded, searched for, and downloaded files thanks to the use of the GAP protocol.
- A VPN system for creating hidden services in the '.gnu' domain and tunneling IPv4 and IPv6 over a P2P network. Additionally, it supports IPv4-to-IPv6 and IPv6-to-IPv4 translation schemes, as well as the creation of IPv4 tunnels over IPv6 and IPv6 tunnels over IPv4.
- The GNUnet Conversation service for making voice calls over GNUnet. GNS is used for user identification, and the content of the voice traffic is transmitted in encrypted form. Anonymity is not currently provided—other peers can track the connection between two users and determine their IP addresses.
- A platform for building decentralized social networks , using the protocol and supporting multicast notification delivery with end-to-end encryption, so that access to messages, files, chats, and discussions is granted only to authorized users (those the messages are not addressed to, including node administrators, cannot read them);
- A system for organizing encrypted email , applying GNUnet to protect metadata and supporting various for key verification;
- A payment system , providing anonymity for buyers but tracking sellers' transactions to ensure transparency and provide tax reporting. It supports various existing currencies and electronic money, including dollars, euros, and bitcoins.
Key innovations in GNUnet 0.13:
- A registry has been put into operation. (GNUnet Assigned Numbers Authority), responsible for assigning names and addresses for GNUnet.
- The implementation of the decentralized domain name system GNS has been aligned with , proposed in the IETF. The NSS-plugin ‘block’ has been established. New SUPPLEMENTAL flags have been added for records that are explicitly not published under the specified label but are returned by the resolver. The gnunet-namestore utility has added a warning output when adding TLSA or SRV records outside of the record. .
- In the key revocation mechanism (GNS/REVOCATION), the function of has been transitioned to use the Argon2 hashing algorithm.
- In the decentralized attribute exchange service (RECLAIM), the ticket size has been increased to 256 bits.
- The transport plugin, which uses the UDP protocol for data transmission, has been moved to the experimental category due to stability issues;
- The key file format and method for serializing ECDSA private keys have been unified with other libraries (old keys will cease to work).
- The library employed for implementing encryption algorithms based on elliptic curves has been introduced. .
- The ability to build utilities with a cURL library that is not linked with gnutls has been added.
- The continuous integration server has been restored. .
- Build dependencies now include the libraries libmicrohttpd, libjansson, and libsodium.
Source: opennet.ru
