Off-the-Record Messaging protocol

{{Short description|Cryptographic protocol}} {{Use dmy dates|date=June 2019}} '''Off-the-Record Messaging''' ('''OTR''') is a cryptographic protocol that provides encryption for instant messaging conversations. OTR uses a combination of AES symmetric-key algorithm with 128 bits key length, the Diffie–Hellman key exchange with 1536 bits group size, and the SHA-1 hash function. In addition to authentication and encryption, OTR provides forward secrecy and malleable encryption.

The primary motivation behind the protocol was providing deniable authentication for the conversation participants while keeping conversations confidential, like a private conversation in real life, or off the record in journalism sourcing. This is in contrast with cryptography tools that produce output which can be later used as a verifiable record of the communication event and the identities of the participants. The initial introductory paper was named "Off-the-Record Communication, or, Why Not to Use PGP".<ref name="not-pgp"/>

The OTR protocol was designed by cryptographers Ian Goldberg and Nikita Borisov and released on 26 October 2004.<ref name="10th-anniversary"/> They provide a client library to facilitate support for instant messaging client developers who want to implement the protocol. A Pidgin and Kopete plugin exists that allows OTR to be used over any IM protocol supported by Pidgin or Kopete, offering an auto-detection feature that starts the OTR session with the buddies that have it enabled, without interfering with regular, unencrypted conversations. Version 4 of the protocol<ref name="version-4"/> has been in development since 2017<ref>{{Cite web |title=Add disclaimer · otrv4/otrv4@0c0847e |url=https://github.com/otrv4/otrv4/commit/0c0847e2d6ee75a1acdce591e606e3f60a28ce3d |access-date=2023-09-20 |website=GitHub |language=en}}</ref> by a team led by Sofía Celi, and reviewed by Nik Unger and Ian Goldberg. This version aims to provide online and offline deniability, to update the cryptographic primitives, and to support out-of-order delivery and asynchronous communication.

According to classified [https://cdn.prod.www.spiegel.de/media/af108995-0001-0014-0000-000000035552/media-35552.pdf NSA documents] published in the ''Der Spiegel'' article on 28 December 2014, the NSA intercepted a conversation between two users, but messages could not be decrypted by the NSA because the users were using the OTR protocol.<ref>{{Cite web |date=28 December 2014 |title=Inside the NSA's War on Internet Security |url=https://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html}}</ref>

== History == OTR was presented in 2004 by Nikita Borisov, Ian Avrum Goldberg, and Eric A. Brewer as an improvement over the OpenPGP and the S/MIME system at the "Workshop on Privacy in the Electronic Society" (WPES).<ref name="not-pgp"/> The first version 0.8.0 of the reference implementation was published on 21 November 2004. In 2005 an analysis was presented by Mario Di Raimondo, Rosario Gennaro, and Hugo Krawczyk that called attention to several vulnerabilities and proposed appropriate fixes, most notably including a flaw in the key exchange.<ref name="Secure OTR"/> As a result, version 2 of the OTR protocol was published in 2005 implementing a variation of the proposed modification that also hides the public keys. Moreover, the possibility to fragment OTR messages was introduced in order to deal with chat systems that have a limited message size, and a simpler method of verification against man-in-the-middle attacks was implemented.<ref name="v2"/>

In 2007 Olivier Goffart published <code>mod_otr</code><ref>{{Cite web|url=https://www.ejabberd.im/mod_otr|title=mod_otr - Man in the Middle module for Off-The-Record | ejabberd|website=www.ejabberd.im}}</ref> for ejabberd, making it possible to perform man-in-the-middle attacks on OTR users who don't check key fingerprints. OTR developers countered this attack by introducing a socialist millionaire protocol implementation in libotr. Instead of comparing key checksums, knowledge of an arbitrary shared secret can be utilised for which relatively low entropy can be tolerated.<ref name="WPES'07"/>

Version 3 of the protocol was published in 2012. As a measure against the repeated reestablishment of a session in case of several competing chat clients being signed on to the same user address at the same time, more precise identification labels for sending and receiving client instances were introduced in version 3. Moreover, an additional key is negotiated which can be used for another data channel.<ref name="v3"/>

Several solutions have been proposed for supporting conversations with multiple participants. A method proposed in 2007 by Jiang Bian, Remzi Seker, and Umit Topaloglu uses the system of one participant as a "virtual server".<ref name="BianSekerTopaloglu"/> The method called "Multi-party Off-the-Record Messaging" (mpOTR) which was published in 2009 works without a central management host and was introduced in Cryptocat by Ian Goldberg et al.<ref name="mpOTR"/>

In 2013, the Signal Protocol was introduced, which is based on OTR Messaging and the Silent Circle Instant Messaging Protocol (SCIMP). It brought about support for asynchronous communication ("offline messages") as its major new feature, as well as better resilience with distorted order of messages and simpler support for conversations with multiple participants.<ref name="SoK"/> OMEMO, introduced in an Android XMPP client called Conversations in 2015, integrates the Double Ratchet Algorithm used in Signal into the instant messaging protocol XMPP ("Jabber") and also enables encryption of file transfers. In the autumn of 2015 it was submitted to the XMPP Standards Foundation for standardisation.<ref name="OMEMO-XEP"/><ref name="OMEMO-Jingle"/>

Currently, version 4 of the protocol has been designed. It was presented by Sofía Celi and Ola Bini on PETS2018.<ref name="no-evidence"/>

== Implementation == In addition to providing encryption and authentication — features also provided by typical public-key cryptography suites, such as PGP, GnuPG, and X.509 (S/MIME) — OTR also offers some less common features:

; Forward secrecy: Messages are only encrypted with temporary per-message AES keys, negotiated using the Diffie–Hellman key exchange protocol. The compromise of any long-lived cryptographic keys does not compromise any previous conversations, even if an attacker is in possession of ciphertexts. ; Deniable authentication: Messages in a conversation do not have digital signatures, and after a conversation is complete, anyone is able to forge a message to appear to have come from one of the participants in the conversation, assuring that it is impossible to prove that a specific message came from a specific person. Within the conversation the recipient can be sure that a message is coming from the person they have identified.

== Authentication == As of OTR 3.1, the protocol supports mutual authentication of users using a shared secret through the socialist millionaire protocol. This feature makes it possible for users to verify the identity of the remote party and avoid a man-in-the-middle attack without the inconvenience of manually comparing public key fingerprints through an outside channel.{{fact|date=February 2026}}

== Limitations == Due to limitations of the protocol, OTR does not support multi-user group chat {{As of|2009|lc=y}}<ref name="multi-party"/> but it may be implemented in the future. As of version 3<ref name="v3"/> of the protocol specification, during authenticated key exchanges an extra symmetric key is derived that can be used for secure communication (e.g., encrypted file transfers) over a different channel. Support for encrypted audio or video is not planned. (SRTP with ZRTP exists for that purpose.) A project to produce a protocol for multi-party off-the-record messaging (mpOTR) has been organized by Cryptocat, eQualitie, and other contributors, including Ian Goldberg.<ref name="mpOTR"/><ref name="mpOTR-Plan"/>

Since the OTR protocol v3 (libotr 4.0.0) the plugin supports multiple OTR conversations with the same buddy who is logged in at multiple locations.<ref name="libotr4"/>

== Client support == {{Infobox software | name = libotr | developer = [https://otr.cypherpunks.ca/people.php OTR Development Team] | genre = Software Library | programming language = C | operating system = Cross-platform | latest release version = 4.1.1 | latest release date = {{start date and age|2016|03|09|df=yes}} | license = LGPL v2.1+<ref name="libotr license"/> | website = {{url|https://otr.cypherpunks.ca/index.php#downloads}} }}

[[File:Off-The-Record authentication dialog..png|thumb| Off-the-Record authentication in Pidgin, using the Socialist millionaires protocol]] These clients support Off-the-Record Messaging out of the box or via plug-ins. {{columns-list|colwidth=30em| * Adium (OS X) * [https://another.im/ Another.IM] * BitlBee (cross-platform), since 3.0 (optional at compile time)<ref name="BitlBee"/> * Blink SIP client (OS X) * CenterIM (Unix-like), since 4.22.2 * ChatSecure (iOS) * [https://coy.im/ CoyIM] * HexChat, for *nix versions, with a third-party plugin<ref>{{Cite web|url=https://github.com/TingPing/hexchat-otr|title=TingPing/hexchat-otr|website=GitHub|language=en|access-date=2017-03-14}}</ref> * HexChat, with a third-party plugin<ref name="hexchat-otr"/> * Jitsi (cross-platform) * Kopete (Unix-like)<ref name="kopete-otr KDE"/><ref name="kopete-otr review"/> * Miranda NG (Microsoft Windows), with a third-party plugin<ref name="MirandaNG"/> * [https://xmpp.org/software/monocles-chat/ monocles chat], XMPP client supports OTR since 2022 * Mozilla Thunderbird, since 68 * Pidgin (cross-platform), with a plugin available from the OTR homepage<ref name="Pidgin"/> * Profanity, since 0.4.1 * Psi (cross-platform)<ref name="Psi"/> * Spark * Zom Mobile Messenger (Android) * Tkabber (cross-platform), since version 1.1<ref name="Tkabber"/> * WeeChat, with a third-party plugin<ref name="WeeChat"/> * climm (Unix-like), since (mICQ) 0.5.4 * irssi, since 1.2.0<ref name="irssi-otr"/> }}

== See also == * {{Portal-inline|Free software}}

== References == {{reflist|colwidth=30em|refs= <ref name="not-pgp">{{cite conference | author1 = Nikita Borisov | author2 = Ian Goldberg | author3= Eric Brewer | title = Off-the-Record Communication, or, Why Not To Use PGP | book-title = Workshop on Privacy in the Electronic Society | date = 28 October 2004 | url = https://otr.cypherpunks.ca/otr-wpes.pdf | access-date = 2014-03-06}}</ref>

<ref name="version-4">{{cite web | author = Sofía Celi, Ola Bini | url = https://github.com/otrv4/otrv4 | title = Off-the-Record Messaging Protocol version 4 | website = GitHub | date = 15 February 2019}}</ref>

<ref name="10th-anniversary">{{cite conference | author = Ian Goldberg | date = 26 October 2014 | title = [OTR-users] Happy 10th anniversary! | url = https://lists.cypherpunks.ca/pipermail/otr-users/2014-October/002515.html | access-date = 2015-04-27}}</ref>

<ref name="multi-party">{{cite web | url = http://lists.cypherpunks.ca/pipermail/otr-users/2009-May/001647.html | title = multi-party OTR communications? (and other OTR details) | author = Ian Goldberg | work = OTR-users mailing list | date = 27 May 2009}}</ref>

<ref name="v3">{{cite web | url = https://otr.cypherpunks.ca/Protocol-v3-4.0.0.html | title = Off-the-Record Messaging Protocol version 3}}</ref>

<ref name="v2">{{cite web | url = https://otr.cypherpunks.ca/Protocol-v2-3.1.0.html | title = Off-the-Record Messaging Protocol version 2}}</ref>

<ref name="mpOTR-Plan">{{cite web | url = https://github.com/cryptocat/cryptocat/wiki/mpOTR-Project-Plan | title = mpOTR Project Plan | author = Nadim Kobeissi | work = Cryptocat wiki on GitHub | date = 1 February 2014}}</ref>

<ref name="libotr4">{{cite web | url = https://lists.cypherpunks.ca/pipermail/otr-announce/2012-September/000058.html | title = pidgin-otr and libotr 4.0.0 released! | author = Ian Goldberg | work = OTR-announce mailing list | date = 4 September 2012}}</ref>

<ref name="Secure OTR">{{cite journal |author1=Mario Di Raimondo |author2=Rosario Gennaro |author3=Hugo Krawczyk | title = Secure off-the-record messaging | publisher = Association for Computing Machinery | journal = Proceedings of the 2005 ACM Workshop on Privacy in the Electronic Society | year = 2005 | pages = 81–89 | url = https://www.dmi.unict.it/diraimondo/web/wp-content/uploads/papers/otr.pdf}}</ref>

<ref name="WPES'07">{{cite book |author1=Chris Alexander |author2=Ian Avrum Goldberg |title=Proceedings of the 2007 ACM workshop on Privacy in electronic society |chapter=Improved user authentication in off-the-record messaging | publisher = Association for Computing Machinery | location = New York | date = February 2007 | pages = 41–47 | url = https://cypherpunks.ca/~iang/pubs/impauth.pdf | doi = 10.1145/1314333.1314340 |isbn=9781595938831 |s2cid=17052562}}</ref>

<ref name="BianSekerTopaloglu">{{cite conference |author1=Jiang Bian |author2=Remzi Seker |author3=Umit Topaloglu | title = Off-the-Record Instant Messaging for Group Conversation | publisher = IEEE | conference = IEEE International Conference on Information Reuse and Integration | year = 2007 | url = https://www.researchgate.net/publication/4272374 | doi = 10.1109/IRI.2007.4296601}}</ref>

<ref name="mpOTR">{{cite book |author1=Ian Avrum Goldberg |author2=Berkant Ustaoğlu |author3=Matthew D. Van Gundy |author4=Hao Chen |title=Proceedings of the 16th ACM conference on Computer and communications security |chapter=Multi-party off-the-record messaging |date=2009 | publisher = Association for Computing Machinery | pages = 358–368 | doi = 10.1145/1653662.1653705 |hdl=11147/4772 | url = https://cypherpunks.ca/~iang/pubs/mpotr.pdf |isbn=9781605588940 |s2cid=6143588}}</ref>

<ref name="SoK">{{cite journal |author1=Nik Unger |author2=Sergej Dechand |author3=Joseph Bonneau |author4=Sascha Fahl |author5=Henning Perl |author6=Ian Avrum Goldberg |author7=Matthew Smith | title = SoK: Secure Messaging | publisher = IEEE Computer Society's Technical Committee on Security and Privacy | journal = Proceedings of the 2015 IEEE Symposium on Security and Privacy | year = 2015 | pages = 232–249 | url = http://ieee-security.org/TC/SP2015/papers-archived/6949a232.pdf}}</ref>

<ref name="OMEMO-XEP">{{cite web |first = Andreas |last = Straub |title = OMEMO Encryption |url = https://xmpp.org/extensions/inbox/omemo.html |date = 25 October 2015 |access-date = 16 January 2016 |work = XMPP Standards Foundation website |url-status = dead |archive-url = https://web.archive.org/web/20160129003540/https://xmpp.org/extensions/inbox/omemo.html |archive-date = 29 January 2016}}</ref>

<ref name="OMEMO-Jingle">{{cite web |first = Daniel |last= Gultsch |title = OMEMO Encrypted Jingle File Transfer |url = https://xmpp.org/extensions/inbox/omemo-filetransfer.html |date = 2 September 2015 |access-date= 16 January 2016 |website = XMPP Standards Foundation website}}</ref>

<ref name="no-evidence">{{cite conference | author = Sofía Celi, Ola Bini | title = No evidence of communication: Off-the-Record Protocol version 4 | date = 21 July 2018 | url = https://petsymposium.org/2018/files/hotpets/7-bini.pdf | access-date = 29 November 2018}}</ref>

<ref name="libotr license">{{cite web | url = https://otr.cypherpunks.ca/index.php#faqs | title = Off-the-Record Messaging}}</ref>

<ref name="BitlBee">{{cite web | url = http://wiki.bitlbee.org/bitlbee-otr | title = BitlBee Wiki | publisher = Wiki.bitlbee.org | date = 25 January 2014 | access-date = 2014-05-15}}</ref>

<ref name="kopete-otr KDE">{{cite web | url = http://kopete-otr.follefuder.org/news.html | title = kopete-otr in KDE for 4.1 | url-status = dead | archive-url = https://web.archive.org/web/20080328080733/http://kopete-otr.follefuder.org/news.html | archive-date = 28 March 2008}}</ref>

<ref name="kopete-otr review">{{cite web | url = http://lists.kde.org/?t=120397998900007&r=1&w=2 | title = kopete-otr review request}}</ref>

<ref name="Psi">{{cite web | url = https://github.com/psi-im/plugins/tree/master/generic/otrplugin | title = OTR Plugin | publisher = Github.com | access-date = 2026-03-18}}</ref>

<ref name="hexchat-otr">{{cite web | url = https://github.com/TingPing/hexchat-otr | title = Off the record plugin for HexChat | website = GitHub | date = 2 December 2021}}</ref>

<ref name="MirandaNG">{{cite web | url = https://code.google.com/p/mirotr/ | title = Miranda OTR Plugin}}</ref>

<ref name="Pidgin">{{cite web | url = https://otr.cypherpunks.ca/#downloads | title = OTR plugin for Pidgin}}</ref>

<ref name="Tkabber">{{cite web |url = https://svn.xmpp.ru/repos/tkabber/trunk/tkabber-plugins/otr/ |title = Tkabber OTR Plugin |url-status = dead |archive-url = https://web.archive.org/web/20140311093019/https://svn.xmpp.ru/repos/tkabber/trunk/tkabber-plugins/otr/ |archive-date = 11 March 2014}}</ref>

<ref name="WeeChat">{{cite web | url = https://github.com/mmb/weechat-otr | title = OTR plugin for WeeChat | website = GitHub | date = January 2019}}</ref>

<ref name="irssi-otr">{{cite web | title = Irssi Changelog - 1.2.0 | url = https://irssi.org/NEWS/#news-v1-2-0}}</ref>

}}

== Further reading == * {{cite journal |author1=Joseph Bonneau |author2=Andrew Morrison | title = Finite-State Security Analysis of OTR Version 2 | date = 21 March 2006 | url = http://www.jbonneau.com/doc/BM06-OTR_v2_analysis.pdf | access-date = 2013-09-05 }} * {{cite conference |author1=Mario Di Raimondo |author2=Rosario Gennaro |author3=Hugo Krawczyk |name-list-style=amp | title = Secure Off-the-Record Messaging | series = Proceedings of the 2005 ACM Workshop on Privacy in the Electronic Society | publisher = Association for Computing Machinery | year = 2005 | url = http://www.dmi.unict.it/diraimondo/web/wp-content/uploads/papers/otr.pdf | access-date = 2013-08-27 }}

== External links == * {{Official website|https://otr.cypherpunks.ca/}} * [https://otr.cypherpunks.ca/Protocol-v3-4.1.1.html Protocol specification] * [https://xmpp.org/extensions/#xep-0364-implementations Implementations of XEP-0364] list of messengers and libraries that supports the OTR. * [https://xmpp.org/extensions/xep-0364.html XEP-0364: Current Off-the-Record Messaging Usage] * [https://csclub.uwaterloo.ca/media/Off-the-Record%20Messaging:%20Useful%20Security%20and%20Privacy%20for%20IM.html Off-the-Record Messaging: Useful Security and Privacy for IM] {{Webarchive|url=https://web.archive.org/web/20131230232710/https://csclub.uwaterloo.ca/media/Off-the-Record%20Messaging:%20Useful%20Security%20and%20Privacy%20for%20IM.html |date=30 December 2013 }}, talk by Ian Goldberg at the University of Waterloo (video) * {{YouTube|aV6-s9o9bVw|'Off-the-Record' Instant Messaging Tutorial (encryption, authentication, deniability, ..)}} * [https://another.im/news/an-odyssey-of-encryption-in-xmpp.html An odyssey of encryption in XMPP] an overview of the current support of the OTR in XMPP clients

Category:Cross-platform free software Category:Cryptographic protocols Category:Cryptographic software Category:Free security software Category:Instant messaging Category:Internet privacy software Category:XMPP

Off-the-Record Messaging protocol

Connections

Linked from

Links to (63 total)