🚀 go-pugleaf

I have a new idea on how someone (NSA for example) could intercept and read
PGP (maybe other) encrypted messages. This is simple based on how PGP works.
To refresh your memory, PGP doesn't actually use RSA, instead, the RSA key
is used to encrypt a second random key. It is this second key which is used
to encrypt the message (actual RSA would be very slow).

  Now suppose they (whoever THEY are) do the following:

1) Modify PGP so that it only generates a small number of secondary keys.
   Since the user is unaware of what key is used, he/she would never know.

2) Make sure this version of the program is widely distributed, or even
   get it to the ftp sites.

3) Messages can now be intercepted (copied) at any point along the way and
   decoded by simply trying all of the secondary keys (not many). i.e. skip
   the RSA decryption.

Please correct me if this is not possible. It is certainly a hell of a lot
simpler than the other methods the paranoids were talking about.

I suppose PGP could be obtained as source code and each person would have
to compile it themself. But how big a change would be needed to restrict
the number of secondary keys?  could it be overlooked anyway? (as you can
tell, I don't have source code, so I don't know.)

Notice, only the sender would need a fake copy of the program, for this to
work. And you can (sometimes) tell a lot from only one end of a conversation.

Just pretending to be paranoid... or am I?

Paul