33

I was wondering how PGP works with a CC. In my understanding, if I send an e-mail to foo@example.com and use baz@example.org in the CC, Enigmail would have to encrypt the e-mail once for every user and send two e-mails.

But in reality, if baz@example.org checks his e-mail he is still listed as CC and not as the main recipient (which would be the case if the e-mail were encrypted once for everyone).

So how exactly does it work?

  • 7
    I just wanted to note that as far as SMTP is concerned the To: and Cc: fields are part of the message, and are distinct from the SMTP RCPT TO envelope fields. With or without encryption, SMTP will need to send a copy of the entire message to every recipient. Think of To: and Cc: as headings you write on a letter, and when you cc you photocopy it and put it in two envelopes with different addresses. When you encrypt individually you only encrypt the message (letter) (including both To: and Cc:), which does not affect how SMTP (envelope) sends it. – Bob Jul 16 '14 at 17:03
  • Note, though, that, for efficiency, SMTP only requires the sender to upload the message content once for any number of recipients, with or without encryption. This is possible with encrypted messages because the message in encrypted with a single one-use "session" key, and that key is encrypted for each of the To, CC, and Bcc recipients (using that recipient's public key) and all the encrypted copies of the session key are included in the mail body. The overhead for one encrypted key block per-user is much less than that of sending a different encrypted message for every user. – dajames Jan 31 '17 at 10:34
53

In the OpenPGP format (that PGP implements), a given email can be encrypted for several recipient with only minute per-recipient size overhead. This is because email encryption actually uses hybrid encryption:

  • A new random symmetric key K is generated for the email to encrypt.
  • The bulk of the email is encrypted with a symmetric encryption algorithm, using K as key.
  • The key K is asymmetrically encrypted with the RSA or ElGamal public key of the recipient.

This is done because asymmetric encryption (RSA, ElGamal) is very limited in processable size, and is also computationally expensive, whereas the symmetric encryption algorithm has no problem processing megabytes of data.

In that setup, if you send the same email to two recipients, then the symmetric encryption with K is done only once; but the key K will be encrypted twice, once with the public key of the first recipient, and once with the public key of the second recipient. Each recipient thus adds only a few hundred bytes to the encrypted email. This is how a "Cc:" can work. Note that it reveals to each recipient who also got the email.

This "Cc:" mechanism is also used when there is only one apparent recipient, because PGP takes care to encrypt the email for both the intended recipient, and yourself -- so that you can later on re-read your own emails from your "Sent" folder. So a basic PGP email already has two recipients.

  • So the PGP message will have the ID of my decryption key? Because otherwise it won't know what key to use when I'm reading the mail I sent. – Franklin Yu Aug 30 at 17:39
16

To add some information to the excellent explanation of Tom, you should be careful with a BCC if you really want to make sure that the BCC is actually a BCC since you can detect from the list of encrypted session keys that the message has been encrypted with some other PGP key. To be precise, the key ID of the PGP key but since most keys are stored on a PGP key server, it should not be difficult to detect who owns the key.

  • Is there any solution to that? – Franklin Yu Aug 30 at 17:50
  • Check the --hidden-recipient GPG option. Another solution is to break up an email with multiple recipients into separate emails and have them separately encrypted. I'm note sure whether a PGP email client can do that. You can however if you use an email encryption gateway. – martijnbrinkers Aug 31 at 9:10
  • I see that this option is mentioned in GPG manual. However, without more details about it, I don’t quite understand how it works. Does it encrypt the symmetric key with the hidden-recipient's key? Is this encrypted key attached to the mail like other normal encrypted keys (for other “known” recipients)? I’m digging in the mailing list, but would be good to get some more help/pointers. – Franklin Yu Sep 5 at 14:02
  • Never mind. I found this old thread and it explained everything. It’s pretty much what I thought: simply attach an encrypted symmetric key for each BCC recipient without specifying the Key ID. This has all the drawbacks that I thought, so I would research about sending separate mail for each BCC receivers. Thanks! – Franklin Yu Sep 5 at 14:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.