3 ms·

I may have missed something here, but the write-up seems to be missing the main problem with OTR, which is that both parties need to be online at the same time

I may have missed something here, but the write-up seems to be missing the main problem with OTR, which is that both parties need to be online at the same time to do the key-exchange to set up the session - at least in OTRv3 (https://otr.cypherpunks.ca/Protocol-v3-4.0.0.html https://otr.cypherpunks.ca/Protocol-v3-4.0.0.html) This is why the Double Ratchet Algorithm was created (back in 2013!) where you prepublish a pool of one-time-keys which can be used to establish sessions without you having to be online - as well as defining how to ratchet the message keys forwards both by new DH exchanges and simple hash ratchets (hence the name Double Ratchet). OTRv3 has the sole advantage that you can trivially tunnel it over any existing synchronous transport (e.g. an IRC DM), given it doesn't have the concept of setting up sessions asynchronously. However, this is a bit of a moot point these days, given modern messaging systems like Matrix, XMPP and Signal natively support the Double Ratchet via Olm, OMEMO & libsignalprotocol respectively - so OTRv3 really is a bit of a historical curiosity at this point. Meanwhile OTRv4 does introduce the idea of offline conversation initialisation (https://github.com/otrv4/otrv4/blob/master/otrv4.md#offline-conversation-initialization https://github.com/otrv4/otrv4/blob/master/otrv4.md#offline-...), but it doesn't seem to have got much traction, relative to the fairly ubiquitous Double Ratchet. (Has anyone seen it in the wild? It looks like coy.im might speak it? https://github.com/otrv4 https://github.com/otrv4 seems fairly dead :/) Finally, lots of E2EE research is going into efficient shared ratchets for group communication rather than 1:1 sessions - such as MLS (https://datatracker.ietf.org/wg/mls/about/ https://datatracker.ietf.org/wg/mls/about/), DMLS (https://matrix.uhoreg.ca/mls/decentralised.html https://matrix.uhoreg.ca/mls/decentralised.html) and DCGKA (https://www.cylab.cmu.edu/news/2021/11/23-group-messaging.html https://www.cylab.cmu.edu/news/2021/11/23-group-messaging.ht...).

Zash 5y ago
Also, as I understand it OTRv4 intentionally does not target multi-device scenarios so it seems unlikely to gain any wider adoption for the kind of use cases XMPP and Matrix target, where being able to see your chats on other devices is considered a feature and not a security issue.
upofadown 5y ago
Off the record was specifically intended to be just that: an online discussion with no evidence of what was said or even that it took place. Forcing both parties to be online at the same time is consistent with that. When the discussion is over then it is done and gone. The protocol used by Signal Messenger adds on the pre-key stuff as sort of a bag on the side to enable asynchronous messaging. It's basically a place to dump a bunch of keys that will later be forgotten as part of a forward secrecy scheme. So stuff sticks around until the recipient goes online and sees the messages. Then the keys are forgotten. At some point the client has to dump in some more keys to keep up the stock.

Zash 5y ago

Also, as I understand it OTRv4 intentionally does not target multi-device scenarios so it seems unlikely to gain any wider adoption for the kind of use cases XMPP and Matrix target, where being able to see your chats on other devices is considered a feature and not a security issue.

upofadown 5y ago

Off the record was specifically intended to be just that: an online discussion with no evidence of what was said or even that it took place. Forcing both parties to be online at the same time is consistent with that. When the discussion is over then it is done and gone. The protocol used by Signal Messenger adds on the pre-key stuff as sort of a bag on the side to enable asynchronous messaging. It's basically a place to dump a bunch of keys that will later be forgotten as part of a forward secrecy scheme. So stuff sticks around until the recipient goes online and sees the messages. Then the keys are forgotten. At some point the client has to dump in some more keys to keep up the stock.