Can I add other key holders to an existing PGP file?

Question

If I have a file that I encrypted with PGP and I'd like to allow other people to view the file after I performed the original encryption can I simply add them to the PGP payload? Since PGP creates a symmetric encryption key that is used to encrypt the file's content, and encrypts that symmetric key with each user's public key then it seems like I could add or remove people from the file by modifying the header and not re-encrypting the entire file again. Is that possible with PGP tools?

Answer 1

While this would theoretically be possible, the common tools do not support it. PGP has --export-session-key and GnuPG has --show-session-key & --override-session-key, but the latter is only used for decryption. For encryption, a new random session key is generated every time.

--show-session-key

Display the session key used for one message. See --override-session-key for the counterpart of this option.

We think that Key-Escrow is a Bad Thing; however the user should have the freedom to decide whether to go to prison or to reveal the content of one specific message without compromising all messages ever encrypted for one secret key. DON'T USE IT UNLESS YOU ARE REALLY FORCED TO DO SO.

--override-session-key string

Don't use the public key but the session key string. The format of this string is the same as the one printed by --show-session-key. This option is normally not used but comes handy in case someone forces you to reveal the content of an encrypted message; using this option you can do this without handing out the secret key.