Differences between revisions 10 and 16 (spanning 6 versions)

OTR with bitlbee

Off-the-Record Messaging, commonly referred to as OTR, is a cryptographic protocol that provides strong encryption for instant messaging conversations. OTR uses a combination of the AES symmetric-key algorithm, the Diffie–Hellman key exchange, and the SHA-1 hash function. In addition to authentication and encryption, OTR provides perfect forward secrecy and malleable encryption.

BitlBee supports OTR natively since 3.0, but it's an optional component.

Note that this requires running your own BitlBee. OTR functionality should not ever be offered on any public server as it only gives a false sense of security! It is important to note that if you have logging turned on for BitlBee then your OTR messages are in vain. Also they could trace your connections via your network connection.

For more information on how to use OTR, see help otr and other existing documentation.

Enabling OTR support

When using distro packages, there is hopefully a bitlbee-plugin-otr package you can install.

When compiling your own BitlBee, pass --otr=1 or --otr=plugin to the configure script.

You'll need the right version of the OTR library installed, with its development headers. See the following table for details.

Version reference

Since the OTR versions seem to be a bit confusing, here's a nice table explaining absolutely everything.

Protocol	Library	.so name (ABI version)	Debian package	Supported bitlbee releases	Supported bitlbee bzr	Stability
v2	libotr 3.2.1	`libotr.so.2.2.1`	libotr2(-dev)	3.0 ... 3.2.1	<=1000	Stable
v3	libotr 4.0.0	`libotr.so.5.0.0`	libotr5(-dev)	Debian's "3.2.1+otr4-1"*	>=1001	Unstable

Note that some debian/ubuntu versions include a release called "3.2.1+otr4-1" which is actually based on bzr 1004, and uses libotr 4.0.0 (libotr5). This version is included in: debian unstable (sid), debian testing (jessie) and ubuntu 14.04 (trusty).

OTR-related settings

otr_policy
- Possible values: never, opportunistic, manual, always
- This setting controls the policy for establishing Off-the-Record connections. See the next section for details.
otr_color_encrypted
- If set to true, BitlBee will color incoming encrypted messages according to their fingerprint trust level: untrusted=red, trusted=green.
otr_does_html
- No one really knows what this does, but it's been suggested that it means "Web frontends use web technologies". /* FIXME */

OTR policies

never: disables the OTR subsystem.
opportunistic: A magic whitespace pattern will be appended to the first message sent to any user. If the peer is also running opportunistic OTR, an encrypted connection will be set up automatically.
manual: OTR connections must be established explicitly using otr connect.
always: enforces encrypted communication by causing BitlBee to refuse to send any cleartext messages at all.

The "magic whitespace pattern" that opportunistic OTR uses consists of 16-40 bytes of either space or tab characters (See the "Tagged plaintext messages" section of the OTR spec for more details). This might cause minor visual issues in some IM clients.

Simple Question and Answer Response

You can authenticate a user's fingerprint by asking a question using the otr smpq

   1 <@alice> otr connect bob
   2 <@alice> otr smpq bob "question question question" answer
   3 <@root> smp: initiating with bob...

On the other side:

   1 <@root> smp: initiated by alice with question: "question question question"
   2 <@root> smp: respond with otr smp alice <answer>
   3 <@bob> otr smp alice answer
   4 <@root> smp: responding to alice...
   5 <@root> smp alice: secrets proved equal, fingerprint trusted

Issues

OTR does NOT work (well) with offline messages.

Without previous or future chat-session, offline messages from either party will not be passed on and no notification will be sent. OTR messages are only being delivered in these scenarios:

User "A" and "B" are in an OTR session, when "B" is disconnecting. Messages from "A" are being delivered after "B" reconnects.
User "A" is attempting an OTR session with the offline-user "B", when "B" is connecting while "A" is still online.

-  ⇤ ← Revision 10 as of 2011-01-02 20:04:57 → 
  Size: 1825
  Editor: c-76-100-129-24
  Comment:
+   ← Revision 16 as of 2014-01-25 17:49:13 → ⇥
  Size: 4741
  Editor: dx
  Comment: mention debian versions that use the new otr
-Deletions are marked like this.
+Additions are marked like this.
 Line 1:
-= Get OTR to work with bitlbee =
+= OTR with bitlbee =
 Line 3:
-Versions 3.0 and newer have bitlbee-otr merged in.
+Off-the-Record Messaging, commonly referred to as OTR, is a cryptographic protocol that provides strong encryption for instant messaging conversations. OTR uses a combination of the AES symmetric-key algorithm, the Diffie–Hellman key exchange, and the SHA-1 hash function. In addition to authentication and encryption, OTR provides perfect forward secrecy and malleable encryption.
 Line 5:
-When using distro packages, there is hopefully a bitlbee-plugin-otr package you can install. When compiling your own !BitlBee, pass --otr=1 or --otr=plugin to the configure script. Make sure that you have libotr (libotr2-dev on Debian) installed, version 3.2.0 or higher!
+!BitlBee supports OTR natively since 3.0, but it's an optional component.
 Line 7:
-Note that this requires running your own !BitlBee. OTR functionality should not ever be offered on any public server as it only gives a false sense of security!
+Note that this requires running your own !BitlBee. OTR functionality '''should not ever be offered on any public server''' as it only gives a false sense of security! It is important to note that if you have logging turned on for !BitlBee then your OTR messages are in vain. Also they could trace your connections via your network connection.
 Line 9:
-For more information on how to use OTR, see "help otr" and other existing documentation.
+For more information on how to use OTR, see {{{help otr}}} and other existing documentation.

== Enabling OTR support ==

When using distro packages, there is hopefully a {{{bitlbee-plugin-otr}}} package you can install.

When compiling your own !BitlBee, pass {{{--otr=1}}} or {{{--otr=plugin}}} to the configure script.

You'll need the right version of the OTR library installed, with its development headers. See the following table for details.

=== Version reference ===

Since the OTR versions seem to be a bit confusing, here's a nice table explaining ''absolutely everything''.

|| '''Protocol''' || '''Library''' || '''.so name (ABI version)''' || '''Debian package''' || '''Supported bitlbee releases''' || '''Supported bitlbee bzr''' || '''Stability''' ||
|| [[https://otr.cypherpunks.ca/Protocol-v2-3.1.0.html|v2]] || libotr 3.2.1 || {{{libotr.so.2.2.1}}} || [[http://packages.debian.org/sid/libotr2|libotr2]](-dev)|| 3.0 ... 3.2.1 || <=1000 || Stable ||
|| [[https://otr.cypherpunks.ca/Protocol-v3-4.0.0.html|v3]] || libotr 4.0.0 || {{{libotr.so.5.0.0}}} || [[http://packages.debian.org/sid/libotr5|libotr5]](-dev)|| Debian's "3.2.1+otr4-1"* || >=1001 || '''Unstable''' ||

Note that some debian/ubuntu versions include a release called "3.2.1+otr4-1" which is actually based on bzr 1004, and uses libotr 4.0.0 (libotr5). This version is included in: debian unstable (sid), debian testing (jessie) and ubuntu 14.04 (trusty).
-Line 13:
+Line 31:
- * {{{otr_policy}}} (global) - see {{{help set otr_policy}}}
 * Any others?
+ * {{{otr_policy}}}
  * Possible values: never, opportunistic, manual, always
  * This setting controls the policy for establishing Off-the-Record connections. See the next section for details.
 * {{{otr_color_encrypted}}}
  * If set to true, !BitlBee will color incoming encrypted messages according to their fingerprint trust level: untrusted=red, trusted=green.
 * {{{otr_does_html}}}
  * No one really knows what this does, but it's been suggested that it means "Web frontends use web technologies". {{{/* FIXME */}}}
-Line 16:
+Line 39:
-(And if anyone could update this Wiki page with more useful info on how to use thing thing that'd be great...)
+== OTR policies ==

 * {{{never}}}: disables the OTR subsystem.
 * {{{opportunistic}}}: A magic whitespace pattern will be appended to the first message sent to any user. If the peer is also running opportunistic OTR, an encrypted connection will be set up automatically.
 * {{{manual}}}: OTR connections must be established explicitly using {{{otr connect}}}.
 * {{{always}}}: enforces encrypted communication by causing !BitlBee to refuse to send any cleartext messages at all.

The "magic whitespace pattern" that opportunistic OTR uses consists of 16-40 bytes of either space or tab characters (See the "Tagged plaintext messages" section of the [[https://otr.cypherpunks.ca/Protocol-v3-4.0.0.html|OTR spec]] for more details). This might cause minor visual issues in some IM clients.
-Line 20:
+Line 50:
-Assuming that you are using a OTR build (see http://geekyschmidt.com/2011/01/02/bitlbee-and-otr-then-add-some-tor if not) then the following steps will walk you through authentication an OTR session:
+You can authenticate a user's fingerprint by asking a question using the {{{otr smpq}}}
-Line 22:
+Line 52:
-. otr connect $buddy
 2. otr smpq $buddy 2+2 4
 3. If your buddy knows your answer then they will reply correctly
 4. Your buddy being a smart cookie will then ask for you to respond to a question: otr smp $buddy answer
 5. Done!
+{{{
#!irc
<@alice> otr connect bob
<@alice> otr smpq bob "question question question" answer
<@root> smp: initiating with bob...
}}}
-Line 28:
+Line 59:
-In step 2 the breakout is question then answer. So if we wanted to do a “Where did we eat lunch 1 Jan” “Taco Bell” then you could do that also. I used 2+2 for simplicity. It is important to note that if you have logging turned on for BitlBee then your OTR messages are in vain. Also they could trace your connections via your network connection.
+On the other side:
-Line 30:
+Line 61:
-== Wiki-Suggestions ==
 * How-To use smp(q) and whats the difference
 * Strip tags after encryption (eg msn font face yadayada)
 *
+{{{
#!irc
<@root> smp: initiated by alice with question: "question question question"
<@root> smp: respond with otr smp alice <answer>
<@bob> otr smp alice answer
<@root> smp: responding to alice...
<@root> smp alice: secrets proved equal, fingerprint trusted
}}}

== Issues ==

OTR does NOT work (well) with offline messages.

Without previous or future chat-session, offline messages from either party will not be passed on and no notification will be sent.
OTR messages are only being delivered in these scenarios:

 1. User "A" and "B" are in an OTR session, when "B" is disconnecting. Messages from "A" are being delivered after "B" reconnects.
 1. User "A" is attempting an OTR session with the offline-user "B", when "B" is connecting while "A" is still online.