Off-the-Record Messaging

Off-the-Record Messaging
This article is licensed under the GNU Free Documentation License. It uses material from the Wikipedia article "Off-the-Record_Messaging".

Example of an OTR instance, the window on the left shows messages as received by iChat and on the right is Adium

Off-the-Record Messaging, commonly referred to as OTR, is a cryptographic protocol that provides strong encryption for instant messaging conversations. OTR uses a combination of the AES symmetric-key algorithm, the Diffie-Hellman key exchange, and the SHA-1 hash function. In addition to authentication and encryption, OTR provides perfect forward secrecy and malleable encryption.

The primary motivation behind the protocol was providing deniability for the conversation participants while keeping conversations confidential, like a private conversation in real life, or off the record in journalism sourcing. This is in contrast with the majority of cryptography tools which resemble more a signed writing on paper, which can be later used as a record to demonstrate the communication event, the participants, and the topic of communication. Unfortunately, in most cases people using ordinary cryptography software are not aware of this and in most cases they would be better served by OTR tools instead. Hence the initial introductory paper was named "Off-the-Record Communication, or, Why Not To Use PGP".¹

The OTR protocol was designed by cryptographers Ian Goldberg and Nikita Borisov. They provide a client library to facilitate support for instant messaging client developers who want to implement the protocol and a special OTR-proxy for AIM, ICQ, and .Mac clients which support proxies.

content

1 Implementation
2 Authentication
3 Limitations
4 Client support
5 External links
6 References

Implementation

In addition to providing encryption and authentication — features also provided by typical public-key cryptography suites, such as PGP, GnuPG, and X.509 (S/MIME) — OTR also offers some less common features:

Perfect forward secrecy: Messages are only encrypted with temporary per-message AES keys, negotiated using the Diffie-Hellman key exchange protocol. The compromise of any long-lived cryptographic keys does not compromise any previous conversations, even if an attacker is in possession of ciphertexts.
Deniable authentication: Messages in a conversation do not have digital signatures, and after a conversation is complete, anyone is able to forge a message to appear to have come from one of the participants in the conversation, assuring that it is impossible to prove that a specific message came from a specific person.

Authentication

As of OTR 3.1 the protocol supports mutual authentication of users using a shared secret through the socialist millionaire protocol. This feature makes it possible for users to verify the identity of the remote party and avoid a man in the middle attack without the inconvenience of manually comparing public key fingerprints through an outside channel.

Limitations

Due to limitations of the protocol, OTR does not currently support multi-user group chat or encrypted file transfers, but these may be implemented in the future. Support for encrypted audio or video is not planned.

Client support

Native

These clients support Off-the-Record Messaging out of the box.

Adium (Mac OS X).
climm (Unix-like), since (mICQ) 0.5.4.
MCabber (Unix-like), since 0.9.4
centerim (Unix-like), since 4.22.2

Via plug-in

The following clients require a plug-in to use Off-the-Record Messaging. Plugin support allows use of OTR with all of a client's implemented instant messaging protocols (e.g. OSCAR, Jabber, MSN, YIM/YMSG etc.).

Pidgin (Cross-platform), with an official plugin available from the OTR homepage ²
Kopete (Unix-like) with a third-party plugin ³ however as of 12th of March 2008 Kopete-OTR is now part of official KDE SVN trunk and will be shipped with the upcoming KDE 4.1.0 release of Kopete.⁴⁵
Miranda IM (Microsoft Windows), with a third-party plugin ⁶
Trillian (Microsoft Windows) with a third-party plugin ⁷
irssi, with a third-party plugin ⁸

Proxy

For those clients which have no native OTR support, a GUI proxy is available. That means that the messages are sent to the proxy unencrypted and get encrypted while they "flow" through this locally installed and running application called a proxy. Presently the proxy provided by the OTR-project supports only the OSCAR-protocol, thus it can be used for .Mac, ICQ, Sametime, and AIM. The OTR proxy is capable of SOCKS5, HTTPS, and HTTP.

Some .Mac, ICQ, and AIM clients that support proxies, but don't support OTR natively: