1. OTR AKE Protocol

2. OTR Data Protocol

3. Security Properties Authentication: Public keys and signatures
Integrity: MACs
Perfect Forward Secrecy: Constant re-keying
Deniability
Weak Deniability: Shared secrets
Strong Deniability: Malleable encryption

4. Found Attacks Version Rollback Attack Strong Deniablity Attack
An attacker may arbitrarily set the version of OTR.
Strong Deniablity Attack
An attacker with strong network control may disable the strong deniability property.
Authentication Failure
Alice may be convinced to commit to an AKE key exchange not knowing who she is speaking with.
Message Integrity Attack
An intruder may arbitrarily alter a message.

5. Strong Deniability Attack
invariant "Strong Deniability"
forall a: PrincipalId do
forall b: PrincipalId do
forall i: IntruderId do
int[i].mac_keys[a][b].k_A >= 0 &
int[i].mac_keys[b][a].k_B >= 0
->
int[i].mac_keys[a][b].k_A = pri[a].c[b].k_ours - 2 &
int[i].mac_keys[b][a].k_B = pri[a].c[b].k_theirs - 1
end
end;

6. Strong Deniability Attack
An intruder may replace published MAC keys

7. Authentication Failure
Problem: Bob never makes it clear he thinks he is talking to Alice

8. Authentication Failure
Bob believes he is talking to Mallory
Alice believes she is talking to Bob

9. Authentication Failure
Bob believes he is talking to Mallory
Alice believes she is talking to Bob
After receiving the third message, Alice commits to a successful key exchange with Bob
Bob will think the exchange failed with Mallory

10. Message Integrity Attack
Re-keying in OTR:
Alice Bob

11. Message Integrity Attack
Re-keying in OTR:
Alice Bob

12. Message Integrity Attack
Re-keying in OTR:
Alice Bob

13. Message Integrity Attack
Re-keying in OTR:
Alice Bob

14. Message Integrity Attack
Mallory blocks a message containing published MAC keys
Mallory uses published keys to re-send a modified message to Bob. Bob thinks it was sent before his message was received.
Negative feature interaction occurring between forward secrecy, strong deniability

15. Message Integrity Attack
The Official Response:
... Good call on this one. Bizarrely, it doesn't turn out to be a security hole in the deployed software because there's a bug in it. (!) The deployed software only publishes MAC keys that were used to receive messages, not ones on messages it sent. This is safe, because it knows for sure that it'll never trust a MAC key that it's already published ...
- OTR Author Ian Goldberg