The web of trust is a graph where the vertices are GPG users (actually, their keys) and the edges are cross-signatures. If we put issues of owner trust aside and assume that all participants only sign after checking the key fingerprints, I can trust a key that has a path between me and the key in the web of trust graph.
If I write an email to someone in the web of trust, I can therefore encrypt the message and keep the content of the email private. I can't hide the metadata of the mail, though: An eavesdropper will still find out when I sent a mail and to whom. Metadata tells a lot about people, and there have been astonishing (not to say, frightening) achievements of guessing people's gender, sexual orientation, income, etc. to a high probability with telephone metadata. (I don't know whether studies have been done with email metadata, but I'd expect similar results)
The question is: How can we hide metadata even in client-encrypted emails?
I propose the following protocol on top of GPG, inspired by Tor:
- I want to send an email to Charlie.
- I look for a path through the web of trust from me to him, of minimum length, say, 3. Let's assume it goes through Alice and Bob.
- Now the multiple encryption step:
- I encrypt the mail with Charlie's key.
- Then I encrypt the already encrypted mail and Charlie's address with Bob's key.
- Then I encrypt all that and Bob's address with Alice's key.
- The sending unwraps everything in the opposite order:
- I send all I got from the last encryption step to Alice.
- Alice decrypts, sees Bob's address and sends everything she decrypted to Bob.
- Bob decrypts once more and sends everything to Charlie.
- Finally, Charlie decrypts for the last time.
If I haven't got anything wrong, this has the following properties:
- Only me and Charlie know the contents of the mail.
- Only me, Charlie and Bob know the final recipient of the mail.
- Only me, Charlie and Alice know the sender of the mail.
Is this working? Is it viable? Why don't we send emails that way?
A few possible downsides might be:
- Someone in the chain might not be online. It might then be clever to send the message along multiple paths.
- Network traffic increases. If an eavesdropper carefully analyses every sent email from me, Alice, Bob and Charlie, they might notice that Alice sends an email to Bob shortly after I write to her, and so on, tracing the mail to Charlie. How much more resources does this need? Is delaying the emails by a short time (say a few minutes) an effective and acceptable countermeasure?