Is OMEMO vulnerable in case of compromised jabber server?

Question

As I've understand OMEMO protocol specification, the initial key exchange between Alice and Bob can be stored on server and in future used for message decryption.

Also the phrase from Conversations, Jabber Android client, official site:

This way, not only your messages are safe but more importantly it is impossible for an outside attacker to intercept your meta data (with whom you are chatting) without attacking your server first.

So, does this means that OMEMO is secure only if server and its administration can be 100% trusted?

Does this mean that OTR with its worse usability has better security?

Answer 1

The security properties of OTR and OMEMO are roughly the same. Both are vulnerable to man-in-the-middle attacks which means an active attacker that has access to the server(s) intercepts all messages and key exchanges and basically pretends to be the other contact to both parties involved. So instead of a session going directly from you to your contact (end-to-end) it goes to the server; gets decrypted; and then the server re-encrypts the messages with the session it hold with your contact. So end-to-end-to-end basically.

To perform a man in the middle attack (assuming that the TLS connection is secure) one would need access to the server. Whether or not that attack involves replacing pre-keys on the server or messing with live handshake messages (like in OTR) is probably not very important since both are relatively easy to do once you have full access to the server.

The only protection against man-in-the-middle attacks is to verify the fingerprints out of band over a secure channel that the hypothetical attacker does not control. Think phone call, a personal website or even better meeting each other in person.

Answer 2

Suppose Alice has never met Bob before—never in her life heard of this ‘Bob’ personage.

Bob initiates a chat with Alice over a Jabber server, which facilitates (a) sending the messages along, and (b) giving Alice and Bob each others' public keys for the first time.

They do a Diffie–Hellman key agreement, of course, so that a passive eavesdropper has no hope of finding the conversation key from the network transcript (more details of how it works). But Mallory, a NITM (enby-in-the-middle) may have compromised the server. Here are three possibilities:

1. The server is honest and uncompromised. In this case, Alice and Bob get to have a secret conversation about how many Nazis are on Twitter and how many statist tools advocate state surveillance and censorship to suppress the Nazis without realizing—or perhaps without saying—how dangerous state censorship regimes are for marginalized groups like queer people.
2. The server is compromised by the NSA. In this case, Alice is actually having a conversation with her personal FBI agent Mallory, who is collecting dossiers on anarchist agitators like me who threaten authoritarian state surveillance regimes.
3. The server is honest and uncompromised, but Bob is Alice's personal FBI agent Mallory who is collecting dossiers, etc.

If Alice has no prior information about Bob, she has no way to distinguish these cases, no matter how secure the protocol is. It's the same for OTR, OMEMO, WhatsApp, Signal, the post, or Twitter.