Analysis of the OpenPGP and OTR protocols

Introduction

The use of encryption mechanisms in the daily digital communication is not very well accepted. One of the most common reasons is the difficulty in the use of software designed to facilitate secure communication.

The reason for this is that the creation of a secure link between two parties is not as easy as it may seem. In order to use common encryption mechanisms like RSA encryption, a shared secret must be know to both parties. Using this secret, often called an encryption key or password, it is possible to create messages that can only be read by people having the same key.

The distribution of this shared key is somewhat difficult however. While parties can negotiate a key using an alternative communications channel, this is often impractical and implies the availability of a trusted channel, which might not be reasonable.

There are many ways to create a trusted channel in an alternative way, using public and private keys. On this site, you will find a description of public/private key encryption in general, and two different protocols implementing some sort of this encryption. We will then introduce a logic with which these protocols can be analyzed, which we will do. Finally, we will show some known security flaws.

In short, we hope that after reading this website, you will appreciate the subtleties involved with encryption and have learned how secure communications are in fact possible, with some restrictions you might not have thought of before.

About the authors

This website was created by Michiel Holtkamp and Pieter de Bie as a result of the course "Multi agent systems". Both are master students Artificial Intelligence at the Rijksuniversiteit Groningen.