Going through the OTR specification I don't quite get why a new DH keys (and hence new symmetric key and hmac key) are generated for each message to be sent. Why is this necessary? I don't think it makes the argument for PFS any stronger. Also it does not have anything to do with deniability as well. Am I missing something here?
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Well it makes the arguments about PFS stronger.
If they would not frequently do a re-keying and securely erasing the old key (note that then they can not even read their own past messages anymore) an adversary that breaks either into Alices or Bobs computer and gets the shared secret can read and link all the previous communication between Alice and Bob. Re-keying eliminates this problem. If you do a re-keying and key erasure after each message, you have the strongest forward secrecy guarantee (although this may be a bit paranoid - but it does not cost really much either).
Note also that the deniabiliy is only concerned with the MAC keys and does not reveal the encryption keys. If you have the DH shared secret you can recompute all keys (in particular the encryption keys) previously used. Someone other may use a previously published MAC key to generate some MAC for a message (deniabiliy), but note that the corresponding correct encryption key can only be known to someone who knows the shared secret. So the adversary can tell apart original from "faked" messages. The longer you use the same shared secret the longer the conversation history the adversary can reconstruct.