otr4j I/O redesign almost complete

otr4j (the java Off-the-Record library), I/O redesign is almost complete now. The plan was to create a dedicated java.net.otr4j.io package that would host various I/O streams for optimal message serialization/deserialization.

The java.net.otr4j.io package development is complete now. It has been developed independently from the existing otr4j code base because it was not possible to both develop the package and refactor it's dependencies at the same time.

As soon as I complete the refactoring and make sure everything works as expected, I will commit the code.

These code changes will fix issue 1 (Enhance serialization/deserialization) and issue 8 (non-(ISO Latin 1) characters do not display correctly), both of which are very important.

---

Require Alt Key

---

Require Alt Key

OTR4j Authenticated Key Eexchange Log in Chainsaw V2

Screen capture of Chainsaw V2 visualizing otr4j running the Off-the-Record (OTR) Authenticated Key Exchange.

Progress by June 25

It's been a while I haven't update the blog. Well this is all but true for the otr4j library!

I have been working on it during the past 14 days, and I am pretty happy to announce that with the latest changes just a few minutes ago, goal "June 25" has been reached. That is, as of revision 068510f52f otr4j can successfully run an Authenticated Key Exchange, and exchange encrypted data.

Tomorrow I will write new tests and improve existing ones to make sure the implementation is fully functional.

After that I will dive into SIP Communicator and will start working for goal July 05.

Progress by June 11

Did a relatively big code refactoring. First of, I purged some elements that where obtrusive like huge javadocs and getters/setters. Both can be added at a later development stage when the library will be relatively stable.

Simplified how messages are assembled/disassembled. Now one can disassemble a message by calling the appropriate constructor, and can assemble messages by calling the toString() method of a message instance.

Implemented state transition handling and message reply dispatching mechanism when receiving

• Plain text messages (with or without whitespace)
  
• Query messages
• Error messages
• D-H Commit messages
• D-H key messages

Created or adopted existing test cases, for refactored functionality (assemble/disassemble) and new functionality of handling state transitions respectively.

The project now uses Mercurial. Get a local copy of the repository with this command:

hg clone https://otr4j.googlecode.com/hg/ otr4j

Progress by June 04

I think it's about time for another update on the otr4j library development progress..

First of all, a new dependency has been added, the BouncyCastle Java Cryptography Library.

The default security provider fails to generate a D-H KeyPair with a modulus larger than 1024 bits with the following message: "Prime size must be multiple of 64, and can only range from 512 to 1024". OTR uses a specific 1536 bit prime, so incorporating the BouncyCastle library was inevitable.

Furthermore, I have revisited some of the methods for assembling/disassembling the various OTR messages. I mostly changed the method signatures, for example instead of passing BigIntegers and byte arrays, I now pass DHPublicKey or PublicKey interfaces, which seems to be a better choice for cleaner code.

I have also made progress on handling state transitions, but this area still needs a lot of work.

I expect that by June 10 (next Wednesday) there will be proper code structure for state transition handling and that the library will successfully "receive" (through test cases) plain text (with or without whitespace tags), query messages, error messages, D-H commit messages and D-H key messages.

Lastly, I started using Mercurial, so to run the code (the tests) you must have mercurial to import the repository. The code for this preview release is available here.

Progress by May 26

Assembling/Disassembling of all OTR messages is now supported. All operations are accompanied by the corresponding test units.

I have also started working in handling state transitions.. It starts to get exciting!!

This is the direct link to this preview release.

P.S. As I read my previous blog posts, it seems that the post length is reduced over time; I want to believe that this is because the actual code length increases..

Progress by May 20

The library can now disassemble all message types except tagged plain text messages. Whoever is interested in the library can download it from the project home page here: http://code.google.com/p/otr4j/ or use this direct link.

Unit testing and logging has been implemented for the so far functionality, so you can extract the library somewhere, run

ant junit

and see what happens.

The current state of OTR libraries in Java

Existing Implementations

• jOTR is a Java framework that provides the base functionality for OTR (Off The Record) support. It is intended to be a java version of the c-based libotr, and be completely compatible with it. Sounds great but, there is no source code although the project is more than a year old.

• Ian Goldberg, lead developer of the OTR development team, mentions an otr library for Java (java-otr) (here) that is in the workings. There is no source code or binaries, only a mentioning so I sent a follow up mail (here) with no reply, so we can't rely on this.

• libjotr ibjotr is a Off-The-Record library in native java. It was developed for libkara but can also be used with other applications written in java. This seems to be the first and only existing implementation for OTR in Java. libjotr is working but it will be hard to use it with an other messenger than kara without modfying the API. It is also OTR v2 only. No support for Version 1. These information are confirmed by Markus, libjotr developer.

OTR4j

Having considered the above solutions, I plan to develop my own library (otr4j) for integration with SipCommunicator and any other IM, as described in my initial post.