I don't have any kind of experience in security, but just on API and app development, and I'm developing an application for doctors and patients which has an added private messaging feature between doctor:patient.

I invested the day studying XMPP, OTR, etc and I decided I'll use a simple POST REST endpoint to post messages, using sockets, instead of XMPP, et. all.

I read that even consumer chatting apps use OTR for end-to-end encryption, but isn't HTTPS enough? I understand the concept of end-to-end encryption, but both doctor and patient will be connected via HTTPS to the server, isn't that enough? Isn't that already a kind of end-to-end encryption?

So is there any benefit on using HTTPS AND OTR?

Is there another secure but easier to implement option and/or technique other than OTR? (compatible with iOS, Android, Windows Phone, Web).

EDIT: OTR has "Deniability: After the chat session is finished, messages cannot be identified as originating from either your correspondent or you." - but in this case the messages have to be identified, specially for liability issues on face of the doctor decisions/instructions/etc.

I don't have any kind of experience in security, but just on API and app development, and I'm developing an application for doctors and patients which has an added private messaging feature between doctor:patient.

I also should be able to retrieve messages exchanged in case of legal issues between doctor:patient, basically a man-in-the-middle.

I invested the day studying XMPP, OTR, etc and I decided I'll use a simple POST REST endpoint to post messages, using sockets, instead of XMPP, et. all.

I read that even consumer chatting apps use OTR for end-to-end encryption, but isn't HTTPS enough? I understand the concept of end-to-end encryption, but both doctor and patient will be connected via HTTPS to the server, isn't that enough? Isn't that already a kind of end-to-end encryption?

So is there any benefit on using HTTPS AND OTR?

Is there another secure but easier to implement option and/or technique other than OTR? (compatible with iOS, Android, Windows Phone, Web).

EDIT: OTR has "Deniability: After the chat session is finished, messages cannot be identified as originating from either your correspondent or you." - but in this case the messages have to be identified, specially for liability issues on face of the doctor decisions/instructions/etc.

I don't have any kind of experience in security, but just on API and app development, and I'm developing an application for doctors and patients which has an added private messaging feature between doctor:patient.

I invested the day studying XMPP, OTR, etc and I decided I'll use a simple POST REST endpoint to post messages, using sockets, instead of XMPP, et. all.

I read that even consumer chatting apps use OTR for end-to-end encryption, but isn't HTTPS enough? I understand the concept of end-to-end encryption, but both doctor and patient will be connected via HTTPS to the server, isn't that enough? Isn't that already a kind of end-to-end encryption?

So is there any benefit on using HTTPS AND OTR?

Is there another secure but easier to implement option and/or technique other than OTR? (compatible with iOS, Android, Windows Phone, Web).

I don't have any kind of experience in security, but just on API and app development, and I'm developing an application for doctors and patients which has an added private messaging feature between doctor:patient.

I invested the day studying XMPP, OTR, etc and I decided I'll use a simple POST REST endpoint to post messages, using sockets, instead of XMPP, et. all.

I read that even consumer chatting apps use OTR for end-to-end encryption, but isn't HTTPS enough? I understand the concept of end-to-end encryption, but both doctor and patient will be connected via HTTPS to the server, isn't that enough? Isn't that already a kind of end-to-end encryption?

So is there any benefit on using HTTPS AND OTR?

Is there another secure but easier to implement option and/or technique other than OTR? (compatible with iOS, Android, Windows Phone, Web).

EDIT: OTR has "Deniability: After the chat session is finished, messages cannot be identified as originating from either your correspondent or you." - but in this case the messages have to be identified, specially for liability issues on face of the doctor decisions/instructions/etc.