---
type: concept
title: OTR Encryption
tags: [encryption, security, xmpp, privacy]
related: [xmpp, pidgin, adium, certificate-fingerprint-verification]
created: 2026-06-30
updated: 2026-06-30
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_instant_messaging_chat_verschluesselte_ko.md"]
---

# OTR Encryption

**OTR (Off The Record)** is a messaging encryption protocol used by the URZ to provide end-to-end encryption (E2EE) for instant messaging. It is designed to be client-agnostic, meaning it can be implemented across different messenger applications.

## Core Principles
- **End-to-End Encryption**: Only the communicating users can read the messages; the server cannot decrypt the content.
- **Deniability**: OTR is designed so that participants can deny having sent a particular message after the conversation has ended.
- **Requirement for Trust**: For a conversation to be fully secure ("Private"), both parties must authenticate each other to prevent man-in-the-middle attacks.

## Authentication Methods
Authentication is the process of verifying that the private key used by the partner actually belongs to them.
- **Manual Fingerprint Comparison**: The most universal method, involving the manual verification of the public key hash (see [[certificate-fingerprint-verification]]).
- **Question & Answer / Passphrase**: Simplified methods available when both parties use [[pidgin]].

## Privacy and Logging
A critical security feature of OTR is that conversations are typically **not logged**. This is because OTR logs are stored in plaintext on the local hard drive, which would compromise the security of the encrypted session. If a user chooses to enable logging, they are ethically and technically required to inform their communication partner.
