[OTR-dev] Secure connections through a connect/disconnect cycle, OTR error messages

verbal verbal at gmail.com
Wed Jan 26 15:52:48 EST 2005


 > > 2)
> > - My friend decides to cancel the OTR session without telling me.
> > - I send a message
> > - I receive: ?OTR Error: You sent encrypted data to <name>, who wasn't
> > expecting it.
> >
> > Question: Is there a way in which the protocol could be expended to
> > send some sort of otr-specific message to the other side letting it
> > know that one person has asked to end the session?
> 
> No, and that's quite on purpose.  There should be NO WAY a network
> message can cause a session to transition from private to not private.
> If there were, you'd have to be really, really careful about whether
> that message is authentic / replayed / etc.  There's also the problem
> of: 1. user (in secure conversation) starts typing private message,
> 2. other side ends the session, sending "session ended" packet to user
> 3. User hits Enter to send his message in the (now unencrypted) session.

i agree with the fact that there should be no way alice can force bob
out of a secure session, but i think what evan is saying is just to..
give bob a heads up so bob's client can make some gui niceness? while
i feel that it is possible to do force bob to exit encrypted mode
securely (encryption/nonce, whatever), it is not something we need to
do and therefore should not add that point of failure into the
protocol.

anywho, UI wise, maybe its good enough to simply infer that alice has
stopped encrypting her messages from the lack of ?OTR messages bob
receives?

verbal



More information about the OTR-dev mailing list