Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Going through the OTR specification I don't quite get why a new DH keys (and hence new symmetric key and hmac key) are generated for each message to be sent. Why is this necessary? I don't think it makes the argument for PFS any stronger. Also it does not have anything to do with deniability as well. Am I missing something here?

share|improve this question

Well it makes the arguments about PFS stronger.

If they would not frequently do a re-keying and securely erasing the old key (note that then they can not even read their own past messages anymore) an adversary that breaks either into Alices or Bobs computer and gets the shared secret can read and link all the previous communication between Alice and Bob. Re-keying eliminates this problem. If you do a re-keying and key erasure after each message, you have the strongest forward secrecy guarantee (although this may be a bit paranoid - but it does not cost really much either).

Note also that the deniabiliy is only concerned with the MAC keys and does not reveal the encryption keys. If you have the DH shared secret you can recompute all keys (in particular the encryption keys) previously used. Someone other may use a previously published MAC key to generate some MAC for a message (deniabiliy), but note that the corresponding correct encryption key can only be known to someone who knows the shared secret. So the adversary can tell apart original from "faked" messages. The longer you use the same shared secret the longer the conversation history the adversary can reconstruct.

share|improve this answer
One could alternatively use forward-secure symmetric cryptography. $\;$ – Ricky Demer May 28 '14 at 19:07
@Ricky Demer The question is about the existing OTR specification and thus I commented on this :) – DrLecter May 28 '14 at 19:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.