Questions tagged [otr]

A cryptographic protocol that provides encryption for instant messaging conversations. Uses a combination of AES symmetric-key algorithm with 128 bits key length, the Diffie–Hellman key exchange with 1536 bits group size, and the SHA-1 hash function. In addition to authentication and encryption, OTR provides forward secrecy and malleable encryption.

Filter by
Sorted by
Tagged with
5
votes
1answer
392 views

How was IronChat compromised?

How was IronChat compromised? https://hotforsecurity.bitdefender.com/blog/police-crack-encrypted-chat-service-ironchat-and-read-258000-messages-from-suspected-criminals-20530.html Dutch police ...
1
vote
0answers
105 views

Solution for well-encrypted group messaging, on Android inside Knox [closed]

I am looking to setup a secure messaging system to be used among friends. Ideally it would be cross-platform (Android-phones using the Knox-container, laptops, Android-tablets with Knox) and support ...
0
votes
2answers
320 views

Is there any advantage on using OTR in a messaging app if the messages are first sent to a REST API server over HTTPS?

I don't have any kind of experience in security, but just on API and app development, and I'm developing an application for doctors and patients which has an added private messaging feature between ...
1
vote
0answers
102 views

OTR and active Man In The Middle attacks [duplicate]

As I'm currently playing around with cryptography, especially OTR, I'm wondering about its security against active MitM attacks. Let's say Alice and Bob created an OTR session, but Eve is acting as ...
7
votes
3answers
3k views

Would Axolotl Ratchet protocol be suitable for encrypting email communication?

Axolotl Ratchet is used by the Signal messenger (formerly known as TextSecure) and an enhanced version of OTR in a way to make it suitable for mobile applications, which has the probability to encrypt ...
2
votes
1answer
173 views

Why is it possible to verify RedPhone inline while not OTR text apps?

Using RedPhone (the right way), one would call, establish a connection and read off the text verification on screen to the other party. If they match, it's ZRTP-secure, if it doesn't it's MITM'd. Why ...