Off-the-record messaging

History

OTR was presented in 2004 by Nikita Borisov, Ian Avrum Goldberg, and Eric A. Brewer as an improvement over the OpenPGP and the S/MIME system at the "Workshop on Privacy in the Electronic Society" (WPES). The first version 0.8.0 of the reference implementation was published on 21 November 2004. In 2005 an analysis was presented by Mario Di Raimondo, Rosario Gennaro, and Hugo Krawczyk that called attention to several vulnerabilities and proposed appropriate fixes, most notably including a flaw in the key exchange. As a result, version 2 of the OTR protocol was published in 2005 which implements a variation of the proposed modification that additionally hides the public keys. Moreover, the possibility to fragment OTR messages was introduced in order to deal with chat systems that have a limited message size, and a simpler method of verification against man-in-the-middle attacks was implemented.

In 2007 Olivier Goffart published mod_otr for ejabberd, making it possible to perform man-in-the-middle attacks on OTR users who don't check key fingerprints. OTR developers countered this attack by introducing a socialist millionaire protocol implementation in libotr. Instead of comparing key checksums, knowledge of an arbitrary shared secret can be utilised for which relatively low entropy can be tolerated.

Version 3 of the protocol was published in 2012. As a measure against the repeated reestablishment of a session in case of several competing chat clients being signed on to the same user address at the same time, more precise identification labels for sending and receiving client instances were introduced in version 3. Moreover, an additional key is negotiated which can be used for another data channel.

Several solutions have been proposed for supporting conversations with multiple participants. A method proposed in 2007 by Jiang Bian, Remzi Seker, and Umit Topaloglu uses the system of one participant as a "virtual server". The method called "Multi-party Off-the-Record Messaging" (mpOTR) which was published in 2009 works without a central management host and was introduced in Cryptocat by Ian Goldberg et al.

In 2013, the Signal Protocol was introduced, which is based on OTR Messaging and the Silent Circle Instant Messaging Protocol (SCIMP). It brought about support for asynchronous communication ("offline messages") as its major new feature, as well as better resilience with distorted order of messages and simpler support for conversations with multiple participants. OMEMO, introduced in an Android XMPP client called Conversations in 2015, integrates the Double Ratchet Algorithm used in Signal into the instant messaging protocol XMPP ("Jabber") and also enables encryption of file transfers. In the autumn of 2015 it was submitted to the XMPP Standards Foundation for standardisation.

Currently, version 4 of the protocol has been designed. It was presented by Sofía Celi and Ola Bini on PETS2018.

Implementation

In addition to providing encryption and authentication — features also provided by typical public-key cryptography suites, such as PGP, GnuPG, and X.509 (S/MIME) — OTR also offers some less common features:

; Forward secrecy: Messages are only encrypted with temporary per-message AES keys, negotiated using the Diffie–Hellman key exchange protocol. The compromise of any long-lived cryptographic keys does not compromise any previous conversations, even if an attacker is in possession of ciphertexts. ; Deniable authentication: Messages in a conversation do not have digital signatures, and after a conversation is complete, anyone is able to forge a message to appear to have come from one of the participants in the conversation, assuring that it is impossible to prove that a specific message came from a specific person. Within the conversation the recipient can be sure that a message is coming from the person they have identified.

Authentication

As of OTR 3.1, the protocol supports mutual authentication of users using a shared secret through the socialist millionaire protocol. This feature makes it possible for users to verify the identity of the remote party and avoid a man-in-the-middle attack without the inconvenience of manually comparing public key fingerprints through an outside channel.

Limitations

Due to limitations of the protocol, OTR does not support multi-user group chat but it may be implemented in the future. As of version 3 of the protocol specification, an extra symmetric key is derived during authenticated key exchanges that can be used for secure communication (e.g., encrypted file transfers) over a different channel. Support for encrypted audio or video is not planned. (SRTP with ZRTP exists for that purpose.) A project to produce a protocol for multi-party off-the-record messaging (mpOTR) has been organized by Cryptocat, eQualitie, and other contributors including Ian Goldberg.

Since OTR protocol v3 (libotr 4.0.0) the plugin supports multiple OTR conversations with the same buddy who is logged in at multiple locations.

Client support

Native (supported by project developers)

These clients support Off-the-Record Messaging out of the box (incomplete list).

• Adium (OS X)
• Blink SIP client (OS X)
• BitlBee (cross-platform), since 3.0 (optional at compile-time)
• CenterIM (Unix-like), since 4.22.2
• ChatSecure (iOS)
• Zom Mobile Messenger (Android)
• climm (Unix-like), since (mICQ) 0.5.4
• Jitsi (cross-platform)
• Kopete (Unix-like)
• Profanity, since 0.4.1
• Psi (cross-platform)
• Psi+ (cross-platform)
• Mozilla Thunderbird, since 68
• monocles chat, XMPP client supports OTR since 2022
• Tkabber (cross-platform), since version 1.1
• irssi, since 1.2.0

Via third-party plug-in

The following clients require a plug-in to use Off-the-Record Messaging.

• HexChat, with a third-party plugin
• Miranda NG (Microsoft Windows), with a third-party plugin
• Pidgin (cross-platform), with a plugin available from the OTR homepage
• WeeChat, with a third-party plugin
• HexChat, for *nix versions, with a third-party plugin

Confusion with Google Talk "off the record"

Although Gmail's Google Talk uses the term "off the record", the feature has no connection to the Off-the-Record Messaging protocol described in this article, its chats are not encrypted in the way described above—and could be logged internally by Google even if not accessible by end-users.

References

References

1. "Add disclaimer · otrv4/otrv4@0c0847e".
2. (28 December 2014). "Inside the NSA's War on Internet Security".
3. "mod_otr".
4. "TingPing/hexchat-otr".
5. [[Nikita Borisov]], [[Ian Goldberg]], [[Eric Brewer (computer scientist). (28 October 2004). "Off-the-Record Communication, or, Why Not To Use PGP".
6. Sofía Celi, Ola Bini. (15 February 2019). "Off-the-Record Messaging Protocol version 4".
7. [[Ian Goldberg]]. (26 October 2014). "[OTR-users] Happy 10th anniversary!".
8. Ian Goldberg. (27 May 2009). "multi-party OTR communications? (and other OTR details)". OTR-users mailing list.
9. "Off-the-Record Messaging Protocol version 3".
10. "Off-the-Record Messaging Protocol version 2".
11. Nadim Kobeissi. (1 February 2014). "mpOTR Project Plan". Cryptocat wiki on GitHub.
12. Ian Goldberg. (4 September 2012). "pidgin-otr and libotr 4.0.0 released!". OTR-announce mailing list.
13. (2005). "Secure off-the-record messaging". Association for Computing Machinery.
14. (2007). "Off-the-Record Instant Messaging for Group Conversation". IEEE.
15. (2009). "Proceedings of the 16th ACM conference on Computer and communications security". Association for Computing Machinery.
16. (2015). "SoK: Secure Messaging". IEEE Computer Society's Technical Committee on Security and Privacy.
17. Straub, Andreas. (25 October 2015). "OMEMO Encryption". XMPP Standards Foundation website.
18. Gultsch, Daniel. (2 September 2015). "OMEMO Encrypted Jingle File Transfer".
19. Sofía Celi, Ola Bini. (21 July 2018). "No evidence of communication: Off-the-Record Protocol version 4".
20. "Off-the-Record Messaging".
21. (25 January 2014). "BitlBee Wiki". Wiki.bitlbee.org.
22. "Kadu 1.0 Release Notes".
23. 0xd34df00d. "OTR Plugin". Github.com.
24. "Short description". Leechcraft.org.
25. (25 October 2013). "source code". MCabber.com.
26. "kopete-otr in KDE for 4.1".
27. "kopete-otr review request".
28. "OTR Plugin". Github.com.
29. "Psi+ snapshots". Github.com.
30. (2 December 2021). "Off the record plugin for HexChat".
31. "Miranda OTR Plugin".
32. "OTR plugin for Pidgin".
33. "Tkabber OTR Plugin".
34. (January 2019). "OTR plugin for WeeChat".
35. "Chatting off the record - Talk Help".
36. "Google Talk - Privacy Policy".
37. "Irssi Changelog - 1.2.0".