Open Bug 1550474 Opened 5 years ago Updated 2 years ago

OTR: Investigate if TB should enable the OTR v3 protocol version

Categories

(Chat Core :: Security: OTR, enhancement)

enhancement

Tracking

(Not tracked)

People

(Reporter: KaiE, Unassigned)

References

Details

Our initial OTR implementation (bug 954310) for Thunderbird will likely be restricted to the v2 protocol version.

A good reason for staying at v2 is that our UI implementation lacks support for multiple sessions, which is explained at
https://github.com/arlolra/ctypes-otr/issues/45#issuecomment-99142846

(See also https://otr.cypherpunks.ca/help/4.0.1/sessions.php?lang=en and https://github.com/arlolra/ctypes-otr/issues/87 and bug 964070.)

v3 Protocol info: https://otr.cypherpunks.ca/Protocol-v3-4.0.0.html

v3 also requires that all v3 messages must contain instance tags.

This bug might be wontfix, and potentially we might consider to add support for v4 at a later time.

Summary: OTR: Investigate if TB shoujld enable the OTR v3 protocol version → OTR: Investigate if TB should enable the OTR v3 protocol version

Per LibOTR mailing list v2 support is being dropped. Minimum for backwards compatibility with other clients will be v3.

https://lists.cypherpunks.ca/pipermail/otr-dev/2018-May/002535.html

Sounds like supporting v2 would be problematic. Basically, if v2 is dropped now likely sometime during 2019 once v4 is out we don't have an upstream library we can use anymore + possible interoperability issues v2<->v4.

I'd think we need to support v3, and supporting v2 is actually a bit questionable.

(In reply to Magnus Melin [:mkmelin] from comment #2)

Sounds like supporting v2 would be problematic. Basically, if v2 is dropped now likely sometime during 2019 once v4 is out we don't have an upstream library we can use anymore + possible interoperability issues v2<->v4.

I assume that there will be a long-tail of people updating their clients, so v2 support is not completely useless. v3 seems like something necessary now though.

Component: General → Security: OTR
Severity: normal → S3
You need to log in before you can comment on or make changes to this bug.