Subject: Re: Plausible deniability (a feature to think about)

From: <[email-masked]>
Date: Thu, 22 Sep 2005 07:21:39 -0700

On Wed, 21 Sep 2005 21:29:55 -0700 "Daniel A. Nagy" 
<[email-masked]> wrote:

> Now, 
>the
>receiving party can be sure that it was composed by the sender, 
>but has no
>means of proving it to a third party. The sender can plausibly 
>deny
>authorship, claiming that the receiver has forged it using his 
>private key
>and the sender's public key.

>Has anybody ever bothered implementing (or even designing an 
>implementation
>of) this in an OpenPGP-friendly manner? 

this can easily be accomplished now, 
within the existing standard, and existing implementations:

any two correspondents,
can simply make a third keypair, with a third name,
and each have the public and private signing and encrypting keys,

anything signed with the third key, authenticates only to the 
correspondents
where the receiver knows that the sender signed it,
but cannot be proved to any third party, 
other than the fact that any possessor of the signing key, signed 
it.

many variations of this are possible;

new signing subkeys, set to expire within hours of the message 
time,

split key systems with shares set to one, and split to only the 
receiver and sender keys, etc.

vedaal

Concerned about your privacy? Follow this link to get
secure FREE email: http://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
http://www.hushmail.com/services-messenger?l=434

Promote security and make money with the Hushmail Affiliate Program: 
http://www.hushmail.com/about-affiliate?l=427

---

From: [email-masked] (Daniel A. Nagy)
Date: Thu, 22 Sep 2005 16:52:08 +0200

> and each have the public and private signing and encrypting keys,

Simply? How exactly do you suggest to share a common key so that the parties
can be reassured that it's their shared secret?
 
> other than the fact that any possessor of the signing key, signed 

Actually, once you share some secret, you don't need to use asymmetric
crypto anymore. A message with MDC encrypted with a shared symmetric key has
all the necessary reassurances. Sharing the secret is the tricky part.

> new signing subkeys, set to expire within hours of the message 

Again, how do you share them?

> receiver and sender keys, etc.

I haven't seen split key implementations either in OpenPGP compliant tools,
though I know they are mentioned in RFC2440.

-- 
Daniel