OWASP Off the record 4 Java Project

• Main
• FAQs
• Acknowledgements
• Road Map and Getting Involved
• Minimum Viable Product

Introduction Privacy is daily reality for many internet users. Eavesdropping user's content and using it for various reason is not desired by many of the application users. Putting trust on communication channel, service provider or government not to intercept your content is not a good idea. OTR framework solves this problem by cryptographically processing the users content in transit and at rest. No eavesdropper can read the content, not even the service provider What is OTR ? OTR4J stands for off-the-record for Java. end-to-end encryption (off-the-record) is a system of communication where only communicating users can read the messages, neither eavesdropper nor communication facilitator channels can read messages. OTR4J provides simple framework and prototype that helps developers to easily implement end-to-end encryption into Java application. Example applications are messaging, file transfer, secure information transfer application Why use otr4j ? It provides high degree of privacy and security. How does it work ? OTR4J uses hybrid cryptography system. It uses RSA and ECDH for key exchanges and AES encryption. Technical details of protocol is explained here Example API Bob sends message to Alice OTRClient bobClient = OTRClient.get(config); bobClint.login("bob", "password"); bobClient.sendMessage("Hello Alice", ALICE_USER_ID); Alice reads messages OTRClient aliceClient = OTRClient.get(config); aliceClient.login("alice", "password"); aliceClient.readMessages(); Licensing Copyright 2016 Jigar Joshi Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Source Code Documentation Wiki Home Page Issue Tracker Project Leader Project Leader - Jigar Joshi ( jigar.joshi@owasp.org ) Related Projects JavaEncoderProject Classifications

News and Events [22 Dec 2016] 1.0-SNAPSHOT is available API APIs for basic functionality is available Basic client with in-memory storage is provided for reference Functionality Privacy in transit is available Message authentication and out of the band verification User authentication for REST MySQL based message store for server Configurable toggles are available for various knobs of encryption

How can I participate in your project?

You can participate in project by multiple ways.

Feature Request Raise your feature request here with detailed information

Contribute code Pick an open issue, forkoff the github repository and create PR

Help in awareness One of the quarter goal is to spread awareness. you can help here by mentioning this project in your blog, tweets and through any other media.

If I am not a programmer can I participate in your project?

Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers and software developers to help.

I have nothing to hide why should I care for privacy?

Some users have thinking that they have got nothing to hide and they are ok with sharing content. This is too local and narrow perspective to privacy concerns.

Volunteers

The OWASP Security Principles project is developed by a worldwide team of volunteers. A live update of project contributors is found here. Your name will be recognized here for your help and volunteer work for this project

The first contributors to the project were:

• Jigar Joshi
• Want to see your name here ? Contribute please

Broader Goal

Provide ability to strengthen privacy by providing stronger end-to-end encryption in transit and stronger encryption at rest to application developers by simpler API for most of the popular languages

Roadmap

As of March, 2017, the highest priorities for the next 3 months are:

This section will keep on updating

• Get other people to review the Code Project Template and provide feedback

• Better API: Simplify APIs and document them for Java

• Privacy at Rest: APIs for privacy at rest

• Awareness: Get 3 clients using this framework in real life [please let us know by email if you already use it. to keep track of the goal's progress]

Getting Involved

Involvement in the development and promotion of OTR4J is actively encouraged! You do not have to be a security expert or a programmer to contribute.

Some of the ways you can help are as follows:

Security Researcher

Are you a security researcher, privacy advocate ? help review & audit protocol design and implementation, suggest functional requirement,

Coding

Are you a Software Developer ? you can help contributing code to solve some of the open issues, We are actively seeking client framework building in Python, Javascript, Objective C

Fan of privacy and OTR

Are you a privacy advocate on internet ? liked the project ? Help spreading awareness of this project

Feedback

Please create the issues for feedback about

• What do like?
• What don't you like?
• What features would you like to see prioritized on the roadmap?

Minimum viable product for this project is a simpler Java API that provides stronger end-to-end encryption in transit and stronger encryption at rest