Yggdrasil P2P mesh E2EE IPv6 network

Re:Yggdrasil P2P mesh E2EE IPv6 network by nyx_land on Tuesday February 01, 2022 @12:16AM (#30158899)

I started using yggdrasil yesterday. The ability to get a static IPv6 address on a meshnet, with encrypted traffic by default, and the option to only accept inbound connections from public keys I trust is incredibly cool. Just like that I can access any of my devices that run ygg from anywhere using standard tools like git or ssh (or git-annex). It makes it really easy to network my devices together without having to screw around with split tunneling a wireguard server and create a DIY set of services to, for example, remotely manage my devices or sync things from one to the other, and that's just for starters. Feels like the Unix philosophy actually being useful for once.

[ Parent | on HN ]

Re:Yggdrasil P2P mesh E2EE IPv6 network by Karrot_Kream on Tuesday February 01, 2022 @03:28AM (#30159951)

In all fairness, you can do that with Zerotier or Tailscale also. But Ygg does also gives you access to the rest of the mesh and that is very cool.

[ Parent | on HN ]

Re:Yggdrasil P2P mesh E2EE IPv6 network by sockaddr on Tuesday February 01, 2022 @01:19PM (#30166763)

Yup. Been doing this for years with zerotier

[ Parent | on HN ]

Re:Yggdrasil P2P mesh E2EE IPv6 network by amaccuish on Tuesday February 01, 2022 @03:26AM (#30159938)

How does key distribution work though? Is it TOFU? I couldn't find anything, just some hand-wavey everything is encrypted.

[ Parent | on HN ]

Re:Yggdrasil P2P mesh E2EE IPv6 network by mawalu on Tuesday February 01, 2022 @04:24AM (#30160310)

Your IPv6 address is the hash of your public key

[ Parent | on HN ]

Re:Yggdrasil P2P mesh E2EE IPv6 network by eadmund on Tuesday February 01, 2022 @08:54AM (#30162374)

That's not hugely secure, though: IPv6 is only 128 bits, which means that the hash is would only provide 64 bits of security if it provided all the bits for the address. And I assume that the IPv6 address is not _only_ the hash, but instead some bits are used to put it into ULA space or similar. ULA uses 7 bits, which means that only 121 bits of the hash are usable, which means it provides 60.5 bits of security, which isn't nothing, but isn't really good enough for anything you care about.

In 2022, 128 bits is the bare minimum, and frankly 192 or 256 are often preferable.

[ Parent | on HN ]

Re:Yggdrasil P2P mesh E2EE IPv6 network by lifty on Tuesday February 01, 2022 @09:31AM (#30162871)

Encryption is done using normal Wireguard keys so it's not a security problem. Im curious if the DHT routing is done based on the key or on the IPv6 address that represents the key.

[ Parent | on HN ]

Re:Yggdrasil P2P mesh E2EE IPv6 network by p_l on Tuesday February 01, 2022 @05:40AM (#30160842)

So it's effectively Host Identity Protocol? Just perhaps with something other than IPsec underneath?

[ Parent | on HN ]

Re:Yggdrasil P2P mesh E2EE IPv6 network by thomaszander on Tuesday February 01, 2022 @06:38AM (#30161250)

> So it's effectively Host Identity Protocol?

The software is essentially a 'node', doing the routing. Whenever it starts it reads the config file to see if there is a private key in there. If no, it will generate a new one for you and that is your identity on the network.

> Just perhaps with something other than IPsec underneath?

That is correct, it uses standard, but not ipsec, encryption based on public key cryptography. A host that saves its private key will thus forever have the same IP address and if it runs services you connect to them using the encryption to its public key.

A node that is configured to connect to the wider yggdrasil public network will thus be reachable on a single IP with an identity that is based on public key cryptography, even if the machine is moving from network to network or even another continent.

[ Parent | on HN ]