2

I am working on a system to transfer short messages while obfuscating the intended recipient.

In essence, it combines many messages encrypted using PGP, and periodically publishes a file containing those messages. The recipients would then download that file and try all messages against their secret key.

Given a message encrypted using PGP, could a potential attacker derive the public key from that message? And as such potentially gain information about the intended recipient?

This assumes that the public key is not published associated with personally identifiable information such as name or email address.

Though I know a multi node mixnet may be more effective and already have existing implementations, I am doing this as an exercise for myself.

Thank you for your time.

Electron-Capture
  • 21
  • 2

1 Answers1

0

In your case OpenPGP messages will consist of PKESK (Public Key Encrypted Session Key Packet) packets followed by a SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet). SEIPD packet is encrypted with the session key and it is impossible to determine the recipient from it. PKESK packet, however, normally contains the fingerprint of the recipient key.

To protect anonymity of the recipient, you need to replace the key ID (in case of version 3 PKESK) or fingerprint (in case of version 6 PKESK) in the PKESK packets with all zeros. This is explicitly allowed by the standard at https://www.rfc-editor.org/rfc/rfc9580.html#name-notes-on-pkesk:

An implementation MAY accept or use a Key ID of all zeros, or an omitted key fingerprint, to hide the intended decryption key. In this case, the receiving implementation would try all available private keys, checking for a valid decrypted session key. This format helps reduce traffic analysis of messages.

For version 3 PKESK see https://www.rfc-editor.org/rfc/rfc9580.html#section-5.1.1-3.2:

An 8-octet number that gives the Key ID of the public key to which the session key is encrypted. If the session key is encrypted to a subkey, then the Key ID of this subkey is used here instead of the Key ID of the primary key. The Key ID may also be all zeros, for an "anonymous recipient" (see Section 5.1.8).

For version 6 PKESK see https://www.rfc-editor.org/rfc/rfc9580.html#section-5.1.2-3.2:

A 1-octet size of the following two fields. This size may be zero, if the key version number field and the fingerprint field are omitted for an "anonymous recipient" (see Section 5.1.8).

tla
  • 136
  • 4