[Specification] Off the Record Messaging Protocol V3

Off-the-Record Messaging Protocol version 3

This document describes version 3 of the Off-the-Record Messaging protocol. The main changes over version 2 include:

• Both fragmented and unfragmented messages contain sender and recipient instance tags. This avoids an issue on IM networks that always relay all messages to all sessions of a client who is logged in multiple times. In this situation, OTR clients can attempt to establish an OTR session indefinitely if there are interleaving messages from each of the sessions.
• An extra symmetric key is derived during AKE. This may be used for secure communication over a different channel (e.g., file transfer, voice chat).

Table of Content

1. Very high level overview

2. High level overview

3. Requesting an OTR conversation

4. Authenticated Key Exchange (AKE)

5. Exchanging data

6. Socialist Millionaires' Protocol (SMP)

7. Details of the protocol

8. Unencoded messages

9. OTR Query Messages

10. Tagged plaintext messages

11. OTR Error Messages

12. Encoded messages 1. Data types 2. Public keys, signatures, and fingerprints 3. Instance Tags 4. D-H Commit Message 5. D-H Key Message 6. Reveal Signature Message 7. Signature Message 8. Data Message

13. Socialist Millionaires' Protocol (SMP) 1. Secret information

14. The SMP state machine 1. Expected Message 2. State Transitions 3. SMP Hash function 4. Receiving a type 2 TLV (SMP message 1) 5. Receiving a type 3 TLV (SMP message 2) 6. Receiving a type 4 TLV (SMP message 3) 7. Receiving a type 5 TLV (SMP message 4) 8. User requests to abort SMP

15. Key Management 1. Computing AES keys, MAC keys, and the secure session id 2. Extra symmetric key 3. Revealing MAC keys

16. Fragmentation

17. The protocol state machine 1. Message state 2. Authentication state 3. Policies 4. State transitions 5. Receiving plaintext without the whitespace tag 6. Receiving plaintext with the whitespace tag 7. Receiving a Query Message 8. Receiving an Error Message 9. User requests to start an OTR conversation

18. Receiving a D-H Commit Message

19. Receiving a D-H Key Message

20. Receiving a Reveal Signature Message

21. Receiving a Signature Message

22. User types a message to be sent

23. Receiving a Data Message

24. User requests to end an OTR conversation

25. Very high level overview