search

ibauersachs / otr4j

Off-the-Record messaging library for Java
Apache License 2.0
65 stars 42 forks source link

Support for asynchronous communication #29

Open mikrosk opened 8 years ago

mikrosk commented 8 years ago

Following our discussion on #28, I'd like to make a feature request / plea :) one more time. I've been working on a p2p communication client for a while and as you can imagine, in such environment is hard to predict the order of delivery, basically to predict delivery at all. According to this blog post: https://whispersystems.org/blog/advanced-ratcheting it would seem that I'm doomed. The author had implemented a "double ratchet" algorithm presented here: https://github.com/trevp/double_ratchet/wiki but as far as I know, no attempt has been made to "backport" it into libotr.

However, when I tried some basic use cases like "send (encrypt) messages 1, 2, 3" and "receive (decrypt) 3, 2, 1" or "receive (decrypt) 3, 1" within a session, there wasn't any problem. Right now I don't care about forward secrecy, I'm happy to have one session per user pair forever (i.e. I'd use OTR mainly as an authentication tool, or, as mentioned in #28, as a symmetric key generator based on the shared secret).

So my questions would be:

cobratbq commented 8 years ago

I intend to answer your questions for as far as I can, but it will take a few days as I am currently very busy.

mikrosk commented 8 years ago

That's all right, I'm looking forward for your answer!

claucece commented 5 years ago

Hey @mikrosk !

Just some news here: the new version of OTR will support asynchronous communication. Check it here: https://github.com/otrv4/otrv4

With OTRv4:

  • In what scenarios OTR does fail when it comes to the order of delivery? Am I safe during the session at least?

None.

  • If the session is safe, what do I have to store to be able to renew the session later? Would be making Session Serializable enough to renew the session?

With OTRv4, you only need to store message keys for a certain amount of time.

  • And most importantly, what are my chances to see the double ratchet algorithm (or something similar) implemented in otr4j? :-)

In OTRv4. Check the C implementation, which already has some parts of the double ratchet algorithm: https://github.com/otrv4/libotr-ng