From Wikipedia, the free encyclopedia

Example of an OTR instance, the window on the left shows messages as received by iChat and on the right is Adium

Off-the-Record Messaging, commonly referred to as OTR, is a cryptographic protocol that provides strong encryption for instant messaging conversations. OTR uses a combination of the AES symmetric-key algorithm, the Diffie-Hellman key exchange, and the SHA-1 hash function. In addition to authentication and encryption, OTR provides perfect forward secrecy and deniable encryption. This is not to be confused with the "off the record" setting in Google Talk, which merely disables logging.

The primary motivation behind the protocol was providing deniability for the conversation participants while keeping conversations confidential, like a private conversation in real life, or off the record in journalism sourcing. This is in contrast with the majority of cryptography tools where, once signed, a cryptographic signature can be proved at a later date. Hence the initial introductory paper was named "Off-the-Record Communication, or, Why Not To Use PGP".^[1]

The OTR protocol was designed by Ian Goldberg and Nikita Borisov, both of whom have considerable backgrounds in cryptography. They provide a client library to facilitate support for instant messaging client developers who want to implement the protocol and a special OTR-proxy for AIM, ICQ, and .Mac clients which support proxies.

In addition to providing encryption and authentication — features also provided by typical public-key cryptography suites, such as PGP, GnuPG, and X.509 (S/MIME) — OTR also offers some less common features:

• Perfect forward secrecy: Messages are only encrypted with temporary per-message AES keys, negotiated using the Diffie-Hellman key exchange protocol. The compromise of any long-lived cryptographic keys does not compromise any previous conversations, even if an attacker is in possession of ciphertexts.
• Deniable authentication: Messages in a conversation do not have digital signatures, and after a conversation is complete, anyone is able to forge a message to appear to have come from one of the participants in the conversation, assuring that it is impossible to prove that a specific message came from a specific person.

As most instant messaging encryption software, OTR does not currently have any means for systematically establishing the authenticity of the participants of a conversation. Typically, users will employ a separate web of trust such as the PGP suite for signing and verifying each other's public key fingerprints. Alternatively, participants can verify each others' fingerprints through a trusted and tamper-resistant channel, such as meeting up in real life.

Due to limitations of the protocol, OTR does not currently support multi-user groupchat or encrypted file transfers. No support for these is currently being anticipated by the authors.

The following clients have native Off-the-Record Messaging support. That includes, that they make OTR usable for all instant messaing protocols which were implemented (e.g. OSCAR, Jabber, MSN, YIM/YMSG etc.).

• Adium (Mac OS X) has native support
• Gaim (Cross-platform), with an official plugin available from the OTR homepage (OTR plugin for gaim)
• Miranda IM (Microsoft Windows), with a third-party plugin (Miranda OTR Plugin)
• Trillian (Microsoft Windows) with a third-party plugin (Trillian OTR)

For those clients which have no native OTR support, a proxy is available. That means that the messages are sent to the proxy unencrypted and get encrypted while they "flow" through this locally installed and running application called a proxy. Presently the proxy provided by the OTR-project supports only the OSCAR-protocol, thus it can be used for .Mac, ICQ, and AIM. The OTR proxy is capable of SOCKS5, HTTPS, and HTTP.

Some .Mac, ICQ, and AIM clients that support proxies, but don't support OTR natively:

• AOL Instant Messenger (Mac OS X, Microsoft Windows)
• iChat (Mac OS X)
• Proteus (Mac OS X)

• OTR project site
• Protocol description

1. ^ Nikita Borisov, Ian Goldberg, Eric Brewer (2004-10-28). "Off-the-Record Communication, or, Why Not To Use PGP" (PDF). Workshop on Privacy in the Electronic Society. Retrieved on 2006-08-29. 

• Joseph Bonneau, Andrew Morrison (2006-03-21). "Finite-State Security Analysis of OTR Version 2" (PDF). Retrieved on 2006-10-24.