🚀 go-pugleaf

-----BEGIN PGP SIGNED MESSAGE-----

Dear cryptographers and PGP enthusiasts,

I was talking to mathew <mathew@mantis.co.uk> today and the following
topic came up. How could you make a PGP message which could be read by,
say, any of certain people, but nobody else? E.g. if you had a mailing
list and wanted anybody on the list to be able to read the message, they
could, without having to send out individually encrypted messages to
everybody.

I was thinking about this a little more and I figured out how it could
be done. The next version of PGP could easily be made to support this
feature.

Here's how PGP works when Alice is encrypting a message to Bob, in
brief. IDEA is the conventional single-key encryption system used by
PGP. Alice generates a random IDEA key (the "session key") and encrypts it
using RSA and Bob's public key. This is then sent along with
the conventionally-encrypted message so that Bob can obtain the
session key with RSA and then decrypt the message.

For a mailing list, it would work similarly. There would be only ONE
session key generated by Alice, and it would be encrypted ONCE FOR EACH
RECIPIENT (Bob, Clarence, David &c.) of the message, using each person's
public key. Then all of these encrypted versions of the session key are
sent along with the conventionally-encrypted message, in one file. As each
encrypted key is relatively small this would be much more efficient than
sending a different version of the message to Bob, Clarence, David.

When receiving the message, Clarence (say) would find the appropriate
encrypted version of the session key, decrypt it and recover the message.
Edward, who was not an intended recipient, cannot read any of the three
encrypted session keys, and hence cannot read the message.

This feature would be valuable enough to warrant its inclusion in any
future versions of PGP. (I have many criticisms and suggestions to improve
PGP but this message is not the place for such suggestions).


Geoffrey T. Falk <gtf1000@cus.cam.ac.uk>

-----BEGIN PGP SIGNATURE-----
Version: 2.1

iQBVAgUBK2GaeTQRcjh0adt3AQG+fQH+I91CgxOFNSc2cbcdegNFLgEh1vu9rIQ8
hYUxjZit2o2aRQ8khd3/yqDcYBPAaodUHjLGc+GE+eRhQU+k6ru9wA==
=W4u9
-----END PGP SIGNATURE-----