Main

Privacy is daily reality for many internet users. Eavesdropping user's content and using it for various reason is not desired by many of the application users. Putting trust on communication channel, service provider or government not to intercept your content is not a good idea.

OTR framework solves this problem by cryptographically processing the users content in transit and at rest. No eavesdropper can read the content, not even the service provider

What is OTR ?

OTR4J stands for off-the-record for Java. end-to-end encryption (off-the-record) is a system of communication where only communicating users can read the messages, neither eavesdropper nor communication facilitator channels can read messages.

OTR4J provides simple framework and prototype that helps developers to easily implement end-to-end encryption into Java application. Example applications are messaging, file transfer, secure information transfer application

Why use otr4j ?

It provides high degree of privacy and security.

How does it work ?

OTR4J uses hybrid cryptography system. It uses RSA and ECDHfor key exchanges and AES encryption. Technical details of protocol is explained here

Example API

Bob sends message to Alice

OTRClient bobClient = OTRClient.get(config);
bobClint.login("bob", "password");
bobClient.sendMessage("Hello Alice", ALICE_USER_ID);

Alice reads messages

OTRClient aliceClient = OTRClient.get(config);
aliceClient.login("alice", "password");
aliceClient.readMessages();

Licensing

Copyright 2016 Jigar Joshi

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

JavaEncoderProject

• [22 Dec 2016] 1.0-SNAPSHOT is available

API

APIs for basic functionality is available

Basic client with in-memory storage is provided for reference

Functionality

Privacy in transit is available

Message authentication and out of the band verification

User authentication for REST

MySQL based message store for server

Configurable toggles are available for various knobs of encryption

FAQs

How can I participate in your project?

You can participate in project by multiple ways.

Feature Request Raise your feature request here with detailed information

Contribute code Pick an open issue, forkoff the github repository and create PR

Help in awareness One of the quarter goal is to spread awareness. you can help here by mentioning this project in your blog, tweets and through any other media.

If I am not a programmer can I participate in your project?

Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers and software developers to help.

I have nothing to hide why should I care for privacy?

Some users have thinking that they have got nothing to hide and they are ok with sharing content. This is too local and narrow perspective to privacy concerns.

Acknowledgements

Volunteers

The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project contributors is found here. Your name will be recognized here for your help and volunteer work for this project

The first contributors to the project were:

• Jigar Joshi
• Want to see your name here ? Contribute please

Road Map and Getting Involved

Broader Goal

Provide ability to strengthen privacy by providing stronger end-to-end encryption in transit and stronger encryption at rest to application developers by simpler API for most of the popular languages

Roadmap

As of March, 2017, the highest priorities for the next 3 months are:

This section will keep on updating

• Get other people to review the Code Project Template and provide feedback

• Better API: Simplify APIs and document them for Java

• Privacy at Rest: APIs for privacy at rest

• Awareness: Get 3 clients using this framework in real life [please let us know by email if you already use it. to keep track of the goal’s progress]

Getting Involved

Involvement in the development and promotion of OTR4J is actively encouraged! You do not have to be a security expert or a programmer to contribute.

Some of the ways you can help are as follows:

Security Researcher

Are you a security researcher, privacy advocate ? help review & audit protocol design and implementation, suggest functional requirement,

Coding

Are you a Software Developer ? you can help contributing code to solve some of the open issues, We are actively seeking client framework building in Python, Javascript, Objective C

Fan of privacy and OTR

Are you a privacy advocate on internet ? liked the project ? Help spreading awareness of this project

Feedback

Please create the issues for feedback about

• What do like?
• What don’t you like?
• What features would you like to see prioritized on the roadmap?

Minimum Viable Product

Minimum viable product for this project is a simpler Java API that provides stronger end-to-end encryption in transit and stronger encryption at rest

NOTOC

Category:OWASP Project Category:OWASP_Builders Category:OWASP_Defenders Category:OWASP_Code