Does Off-The-Record protocol provide future (backward) secrecy? I know Signal provides future (backward) secrecy, and that it is based on Off-The-Record protocol. However, does OTR by itself also provide future secrecy?
I think so. OTR generates a new DH key pair for each round of message, similar to the DH ratchet in Signal. Also, OTR stands out by having a property called deniable authentication. This basically means the messages are only authenticated during a session between the communicating parties but not after the session. In fact, the MAC key will be revealed after the session is closed.