Two different fingerprints tied to one OTR

#1

So this may be a bit of a n00b question, but I can't figure out why my colleague is having such a tough time with this...

A colleague of mine just set up OTR for the first time. For whatever reason, there are two fingerprints attached to his account. The fingerprint changes whether he contacts people in Adium, and then when he changes over to ChatSecure on his phone.

Is this, for lack of a better term, a thing? I have never had this problem when using OTR, i've seen the same fingerprint no matter what client I've used (or maybe I haven't and just thought so).

Any help would be appreciated.

#2

This is a thing.

This shouldn't be concerning, as long as you can verify that both fingerprints correspond to keys created by your colleague (for example by calling him and having him read the fingerprints to you).

When your colleague set up Adium, he generated a long term identity key pair and a corresponding fingerprint. When he set up ChatSecure, he did the same thing again. So, he likely has two keys, even though it seems that he is using one Jabber account, from your description. This is normal.

However, I'm confused that you were able to have the same fingerprint on different devices, when using different clients. Usually this is not the case unless you go out of your way to load the same key onto each device.

#3

Thank you!