Possible chosen-ciphertext attack on receiver anonymity

[Brent Waters]

Hi,

I thought that there might be a chosen-ciphertext attack on receiver anonymity 
for a message to multiple recipients. I wanted to check my understanding of how 
GPG handles a certain case to see if this is a problem.

The specific case I am worried about is when the "throw-keyid" option is used 
to encrypt a message to multiple recipients. My understanding is that the 
throw-keyid option should hide the identity of the a receiver of the message 
(by throwing away the key-id) even from other receivers of a message. Suppose I 
made such an encryption of M to Alice and Bob, then the hybrid encryption (at a 
high level) would look something like this:
1)Choose random symmetric key key K
2)Ciphertext: (C1,C2,C')=E_{KeyAlice}(K)E_{KeyBob}(K),E_K(Message)
where C1,C2 are asymmetric encryption and C' is a symmetric key encryption.

At this point Alice and Bob can both decrypt the message, but neither can tell 
if the other was the other receiver. Suppose Bob suspects Alice was the other 
receiver. Then he can create a ciphertext:
(C1,C'')=E_{KeyAlice}(K)E_K(NewMessage)
and send this to Alice, if Alice responds to this in a meaningful way she was 
the other receiver. NewMessage could be something simple like "Do you want to 
go to lunch?" which would likely elicit a response. Note, this can be a problem 
even if the ciphers are CCA-secure.

Anyway, I wanted to see if my understanding of how this was implemented was 
correct. Can anyone comment on this?

-Brent