While looking at the different versions of OTR protocol I discovered a strange thing: there is no trace of the patch for the weaknesses that were noted in “Finite-State Security Analysis of OTR Version 2”.

It sounds very strange to me that authors of OTRv2 and OTRv3 did not manage to patch up the weaknesses and did not even bother to mention it as “to do” (as far, as I understood).

Maybe I'm just not experienced enough to detect an implicit patch in an article or implementation, or maybe noted vulnerabilities are pure theoretical and not considered harmful so marked as “won’t fix”? Can anyone clarify this?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.