existing keys as subkey

[David Shaw]

On Thu, Oct 03, 2002 at 04:01:23PM +0200, Ingo Kl=F6cker wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>=20
> On Thursday 03 October 2002 14:50, David Shaw wrote:
> > On Thu, Oct 03, 2002 at 11:49:50AM +0200, Ingo Kl=F6cker wrote:
> > > This is how the encrypted mailinglist works:
> > > When someone what's to sent a message to the mailinglist he
> > > encrypts the message with the mailinglist key.
> > > The mailinglist manager receives the message, decrypts it,
> > > re-encrypts it for all subscribers and then sends it to the
> > > subscribers. In order to protect the privacy of the subscribers the
> > > message should be encrypted for each subscriber separately.
> >
> > That would be a lot of messages, and you lose the nice mailing list
> > ability to send in bulk (i.e. you have more than one subscriber at a
> > given domain, so you send one copy to that domain and let their mail
> > system deliver it multiple times).
> >
> > You can use --throw-keyid to remove the key IDs of the subscribers,
> > so the only thing that an attacker would know about the subscribers
> > is how many of them there are.  You can throw some extra fake
> > "subscribers" into the mix as well to throw off the count as well ;)
>=20
> And in order to avoid too large messages (at least one encrypted sessio=
n=20
> key per subscriber) one could combine both ideas by encrypting each=20
> message with --throw-keyid for every group of subscribers in the same=20
> domain (and for every PGP user) separately.

Good idea.  I don't think anybody has ever really implemented
something like this.  It would be interesting to see how encryption
interacts with the usual mailing list stuff like VERP (where you must
send a single copy per user).  What does the usual "many bounce
messages =3D=3D removed from list" rule mean when a remailer is used?
Will the messages be flagged as viruses (unreadable binary gibberish)?

David

--=20
   David Shaw  |  dshaw@jabberwocky.com  |  WWW http://www.jabberwocky.co=
m/
+------------------------------------------------------------------------=
---+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson