Going through the OTR specification I don't quite get why a new DH keys (and hence new symmetric key and hmac key) are generated for each message to be sent. Why is this necessary? I don't think it makes the argument for PFS any stronger. Also it does not have anything to do with deniability as well. Am I missing something here?


1 Answer 1


Well it makes the arguments about PFS stronger.

If they would not frequently do a re-keying and securely erasing the old key (note that then they can not even read their own past messages anymore) an adversary that breaks either into Alices or Bobs computer and gets the shared secret can read and link all the previous communication between Alice and Bob. Re-keying eliminates this problem. If you do a re-keying and key erasure after each message, you have the strongest forward secrecy guarantee (although this may be a bit paranoid - but it does not cost really much either).

Note also that the deniabiliy is only concerned with the MAC keys and does not reveal the encryption keys. If you have the DH shared secret you can recompute all keys (in particular the encryption keys) previously used. Someone other may use a previously published MAC key to generate some MAC for a message (deniabiliy), but note that the corresponding correct encryption key can only be known to someone who knows the shared secret. So the adversary can tell apart original from "faked" messages. The longer you use the same shared secret the longer the conversation history the adversary can reconstruct.

  • $\begingroup$ One could alternatively use forward-secure symmetric cryptography. $\;$ $\endgroup$
    – user991
    Commented May 28, 2014 at 19:07
  • $\begingroup$ @Ricky Demer The question is about the existing OTR specification and thus I commented on this :) $\endgroup$
    – DrLecter
    Commented May 28, 2014 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.