I understand that when I send a message to my friend Bob using his public key, it's a 1 way encryption. However, if I add my own public key to the list of recipients, it allows me to later decrypt what I sent.

By adding my public key, is that any less secure?


@mricon points out good considerations both for and against, and I'd like to add another aspect: the difficulty in obtaining unauthorized access to the corresponding private key and thus the plaintext of the communications.

Suppose the two keys are similarly secure. This includes everything from the easily measurable key length, to the random entropy that went into them at key creation time, passphrase strength, firewalling, difficulty in installing a keylogger, and whatnot. Then the difference in security from adding a second key should be negligible: you are adding another attack vector, but an attacker must choose one or the other and they are similarly difficult. Hence, no big change unless the attacker can work on both attacks simultaneously, and even if they can, no big loss all things considered. (Two possible attackable keys represents a lowering of the security by a single bit of effective key length. Are you concerned with whether the session key has 255 or 256 bits of entropy, and if you are, what is the real entropy of the session key?)

However, if one key is significantly more secure than another, an attacker can just go after the less protected key. If one belongs to your grandmother who just use the computer to stay in touch with children and grandchildren who only installed a public key encryption package to make you happy but doesn't understand how to really use it, and the other is highly secured, it would make sense for an attacker to go for the less-protected key if they can be considered equivalent.

For the purposes of decrypting a specific message encrypted to multiple keys, generally all recipient keys can be considered equivalent. For the purposes of wholesale decryption of a person's communications, only a single key (their own) will do. This becomes a lot more difficult if there is no single key that can decrypt a person's sent traffic.

Since you are asking this on Security.SE, your own key probably isn't among the least protected or secure. However, in the general case, it cannot be ruled out that it would be the least secure of the recipient keys, in which case by encrypting to your own key as well as the recipients' keys you would lower the bar for obtaining unauthorized access to the plaintext.

There is also the consideration of convenience, including your own easy access to plaintext of past sent messages. As mricon points out, lots of replies are likely to include large chunks of plaintext anyway, making it easily possible to puzzle together what you are talking about even though an attacker might not gain access to every single word written.

TL;DR: In theory, it could lower the security of the overall system. In practice, the convenience factor often trumps the very slight decrease in security.

| improve this answer | |

On the one hand, if someone compromises your private key, such person would then be able to read your past encrypted correspondence. If that's not an acceptable risk to you, then you shouldn't encrypt to self. On the other hand, more often than not, the person responding to you would leave your previous message body intact anyway (especially when top-posting), so an attacker would be able to piece together what you were talking about anyway.

I'd say the security gains of not encrypting to self are not worth the inconvenience of not being able to read your own sent mail.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.