A clarification about OTR shared secrets - how long need they be secret?

Question

A quick question on confirmation/authentication with the OTR protocol.

OTR shared secrets/Q&A when used to authenticate your partner in conversation, am I correct my understanding that they DO NOT need to remain secret after the initial key exchange has finished?

An example of how this might be important, say, Alice asks Bob, who was Best man at Carol's wedding; this is not per se secret, but if Bob can answer quicker than the NSA can, once the NSA figures out who Dave's best man was when he married Carol, is this information useful to them in going back?

My understanding is that it is not and that the shared secret need only be shared at the instant that the key exchange is being done.

Or; if Alice had a function, f(x) that did some computations on x, and could be sure that Bob could do these computations (and/or figure out what the function was) before Eve does; etc.

Responses are much appreciated. Regards NTP

Answer 1

Yes. OTR uses the socialist millionaires protocol, which is an interactive protocol Alice and Bob use to establish confidence that their secrets match (without either of them disclosing the secret). If the authentication succeeded, both parties store the public key fingerprint of the other and mark it as trusted. The shared secret is not used any further (e.g., to derive keys used in later stages), thus knowledge of it is useless to an attacker after the initial authentication step has finished. (That is, after the authentication was done, there is no difference to manually having compared the fingerprints.)

Of course, if Alice and Bob authenticate again at a later point in time (e.g., because one of them created a new key pair), they must not use the same shared secret if it is not secret any more. (This should be obvious.)