He said OTR messaging would give the participants the security without leaving any more trace of the conversation than today's instant-messaging clients-a worry for the privacy-centric security community. Goldberg said current messaging is insecure and criticized other solutions for leaving around logs and encryption keys that could be used as proof that a conversation happened. People worried about instant-messaging security can download the software from the duo's site. Goldberg and Borisov presented their program at the annual CodeCon gathering of developers Saturday. After that, the two participants can chat securely the conversation is encoded so that others cannot intercept and read it. If the user accepts the credentials of the person contacting him, the key will be stored on his computer so that in the future, the sender is considered to be trusted. When a previously unregistered user wants to have an OTC conversation, a dialog box will appear with a digital key, identifying the sender. In order for a secure and deniable IM conversation to occur, both parties need to have the off-the-record program installed on Gaim or use America Online's Instant Messenger with a server set up to be a proxy with software also developed by Goldberg and Borisov, the researchers said. 'If tomorrow, my computer is broken into and the encryption key is stolen, the attacker can't read future messages,' said Goldberg, a graduate of Berkeley. That attribute, known in cryptography as perfect forward security, also prevents snoopers from reading any copies of the conversation. The result, dubbed off-the-record (OTR) messaging by security researchers Ian Goldberg and Nikita Borisov, is a plug-in for the Gaim instant-messaging client that enables encrypted messages sans leaving a key-a sequence of characters-that could be used to verify that the conversation happened.

Two researchers at the University of California at Berkeley have created an add-on to instant messaging that they claim will enable the participants to identify each other and have a secure conversation without leaving any proof that the chat occurred.

SAN FRANCISCO-When you hit the Send button on an instant message, do you really know who is on the other end?

Secure email solutions cnet