Why does PGP work with the CC field in e-mails?

Question

I was wondering how PGP works with a CC. In my understanding, if I send an e-mail to foo@example.com and use baz@example.org in the CC, Enigmail would have to encrypt the e-mail once for every user and send two e-mails.

But in reality, if baz@example.org checks his e-mail he is still listed as CC and not as the main recipient (which would be the case if the e-mail were encrypted once for everyone).

So how exactly does it work?

Answer 1

In the OpenPGP format (that PGP implements), a given email can be encrypted for several recipient with only minute per-recipient size overhead. This is because email encryption actually uses hybrid encryption:

• A new random symmetric key K is generated for the email to encrypt.
• The bulk of the email is encrypted with a symmetric encryption algorithm, using K as key.
• The key K is asymmetrically encrypted with the RSA or ElGamal public key of the recipient.

This is done because asymmetric encryption (RSA, ElGamal) is very limited in processable size, and is also computationally expensive, whereas the symmetric encryption algorithm has no problem processing megabytes of data.

In that setup, if you send the same email to two recipients, then the symmetric encryption with K is done only once; but the key K will be encrypted twice, once with the public key of the first recipient, and once with the public key of the second recipient. Each recipient thus adds only a few hundred bytes to the encrypted email. This is how a "Cc:" can work. Note that it reveals to each recipient who also got the email.

This "Cc:" mechanism is also used when there is only one apparent recipient, because PGP takes care to encrypt the email for both the intended recipient, and yourself -- so that you can later on re-read your own emails from your "Sent" folder. So a basic PGP email already has two recipients.

Answer 2

To add some information to the excellent explanation of Tom, you should be careful with a BCC if you really want to make sure that the BCC is actually a BCC since you can detect from the list of encrypted session keys that the message has been encrypted with some other PGP key. To be precise, the key ID of the PGP key but since most keys are stored on a PGP key server, it should not be difficult to detect who owns the key.