Re: how vulnerable is "hidden-encrypt-to"

2012-08-22 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Monday 20 August 2012 at 9:42:31 PM, in , ved...@nym.hush.com wrote: > The simplest way to do that is to send the message > encrypted to only one recipient at a time. If I recall correctly, the QDPGP plugin for using PGP with Pegasus Mail

Re: how vulnerable is "hidden-encrypt-to"

2012-08-21 Thread vedaal
On Tue, 21 Aug 2012 11:59:20 -0400 Jens Lechtenboerger wrote: >Also, "different" would need to be random and of sufficient >length... = It is. See RFC4880, (it's one of the 'MUST' implementations for all open-pgp's) http://tools.ietf.org/html/rfc4880 (specific sections will be quoted

Re: how vulnerable is "hidden-encrypt-to"

2012-08-21 Thread Jens Lechtenboerger
On Mo, Aug 20 2012, ved...@nym.hush.com wrote: > On Mon, 20 Aug 2012 13:57:41 -0400 Jens Lechtenboerger > wrote: > >>In contrast, I interpreted the original question in terms of >>recipient anonymity: Bob wants to encrypt a message to some >>undisclosed list of recipients (say, including Alice an

Re: how vulnerable is "hidden-encrypt-to"

2012-08-20 Thread vedaal
On Mon, 20 Aug 2012 13:57:41 -0400 Jens Lechtenboerger wrote: >In contrast, I interpreted the original question in terms of >recipient anonymity: Bob wants to encrypt a message to some >undisclosed list of recipients (say, including Alice and Eve), and >nobody should be able to figure out who (e

Re: how vulnerable is "hidden-encrypt-to"

2012-08-20 Thread Sin Trenton
> = > > The one sending the message really is in control here ;-) > The sender can use hidden encrypt to ANY public key. > > i.e. if Alice is sending the message and wants to hide her > identity, > nothing prevents her from using throw-keyid with Bob's public key > instead of her own, or NI

Re: how vulnerable is "hidden-encrypt-to"

2012-08-20 Thread Jens Lechtenboerger
On Mo, Aug 20 2012, ved...@nym.hush.com wrote: > On Mon, 20 Aug 2012 09:38:49 -0400 Jens Lechtenboerger > wrote: > >> if a message M is encrypted to you and other >>recipients using RSA, then you are of course able to obtain the >>session key K. Now, if you suspect Alice to be a recipient then

Re: how vulnerable is "hidden-encrypt-to"

2012-08-20 Thread vedaal
On Mon, 20 Aug 2012 09:38:49 -0400 Jens Lechtenboerger wrote: > if a message M is encrypted to you and other >recipients using RSA, then you are of course able to obtain the >session key K. Now, if you suspect Alice to be a recipient then >you download her public key from a key server and encr

Re: how vulnerable is "hidden-encrypt-to"

2012-08-20 Thread Jens Lechtenboerger
On Sa, Aug 18 2012, Daniel Kahn Gillmor wrote: > On 08/17/2012 11:16 AM, Hauke Laging wrote: >> Am Fr 17.08.2012, 09:56:56 schrieb auto15963931: >>> or what key ID >>> had been used in conjunction with that option? Thanks. >> >> You need the private recipient key in order to find out that key >>

Re: how vulnerable is "hidden-encrypt-to"

2012-08-19 Thread MFPA
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hi On Saturday 18 August 2012 at 3:36:21 PM, in , Daniel Kahn Gillmor wrote: > And it's also possible to rule out a given person as an > intended recipient, e.g. if they have a 2048-bit RSA > key and the ESK packet targets 4096-bit el gamal. You

Re: how vulnerable is "hidden-encrypt-to"

2012-08-18 Thread Hauke Laging
Am Sa 18.08.2012, 10:36:21 schrieb Daniel Kahn Gillmor: > It's worth observing that you can still detect the algorithm used and > the size of the key, even when the keyid is all zeros. So if someone > has a particularly unusual key size (or is an early adopter of an > unusual key type, like ECC),

Re: how vulnerable is "hidden-encrypt-to"

2012-08-18 Thread Daniel Kahn Gillmor
On 08/17/2012 11:16 AM, Hauke Laging wrote: > Am Fr 17.08.2012, 09:56:56 schrieb auto15963931: >> or what key ID >> had been used in conjunction with that option? Thanks. > > You need the private recipient key in order to find out that key ID. It's the > use of this option that you cannot get thi

Re: how vulnerable is "hidden-encrypt-to"

2012-08-17 Thread Jean-David Beyer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hauke Laging wrote: > Am Fr 17.08.2012, 21:05:32 schrieb auto15963931: > >> In the example >> of yours it appears as though the message was encrypted to two different >> keys, one of which was hidden and the other not. Is that right? > > That is righ

Re: how vulnerable is "hidden-encrypt-to"

2012-08-17 Thread Hauke Laging
Am Fr 17.08.2012, 21:05:32 schrieb auto15963931: > In the example > of yours it appears as though the message was encrypted to two different > keys, one of which was hidden and the other not. Is that right? That is right. --hidden-encrypt-to needs other recipients. But you may use ‑‑throw-keyids

Re: how vulnerable is "hidden-encrypt-to"

2012-08-17 Thread auto15963931
Hauke Laging: > Am Fr 17.08.2012, 09:56:56 schrieb auto15963931: >> Is there any way on heaven or earth for someone to discover from a >> message, one sent to them or to another person, whether the encrypted >> message had been made with an option "hidden-encrypt-to" > > Sure. > > start cmd:> LC_

Re: how vulnerable is "hidden-encrypt-to"

2012-08-17 Thread Hauke Laging
Am Fr 17.08.2012, 09:56:56 schrieb auto15963931: > Is there any way on heaven or earth for someone to discover from a > message, one sent to them or to another person, whether the encrypted > message had been made with an option "hidden-encrypt-to" Sure. start cmd:> LC_ALL=C gpg --list-packets te

how vulnerable is "hidden-encrypt-to"

2012-08-17 Thread auto15963931
Is there any way on heaven or earth for someone to discover from a message, one sent to them or to another person, whether the encrypted message had been made with an option "hidden-encrypt-to" or what key ID had been used in conjunction with that option? Thanks. _