Re: On email and web security

Doug Royer <> Wed, 13 January 2016 22:34 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 2106B1A878C for <>; Wed, 13 Jan 2016 14:34:28 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -0.979
X-Spam-Status: No, score=-0.979 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, MISSING_HEADERS=1.021, SPF_PASS=-0.001] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 3yxZlsBx97Fc for <>; Wed, 13 Jan 2016 14:34:26 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:400e:c00::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id CE1BA1A877C for <>; Wed, 13 Jan 2016 14:34:26 -0800 (PST)
Received: by with SMTP id 65so88205951pff.2 for <>; Wed, 13 Jan 2016 14:34:26 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=subject:references:cc:from:organization:message-id:date:user-agent :mime-version:in-reply-to:content-type; bh=BZ/aCn4pWw++OiEbVsTwdUsRLV/JYJ2Xu1ymFDgHzkE=; b=IB3dexVW9JwgQQkBlfuyb1aUa9gxo0GqDCdbxW7JgxM50h3WDh/qD15ZvHpmWJh0mh KA7gY52d858AOshelfQhmBqTb2BQv44O/uqV6F/CHsCx1IyI7FOJ+MQWLCSnGTJO8GJ9 RxvgLpyogADKw76kzr8CCymXya5HXMTYSo/qdTfHyEZhRxBrrgcB7qy5RuIzb97Ad5iF cc+HX3WI/1rTG1HiUspgcAupiJ23gPbmBILgseuj08G7vrdzWh5Nw9dyDsX6tQbBdbr8 tdVT3O3BQwVcstJVLdkd34Z5mk0YZif+r53Zrz2TM0iz+Y4sFiQOl2tJne44DEl+Cg+Q HJhg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:subject:references:cc:from:organization :message-id:date:user-agent:mime-version:in-reply-to:content-type; bh=BZ/aCn4pWw++OiEbVsTwdUsRLV/JYJ2Xu1ymFDgHzkE=; b=j5sbO35bT2QpRiP/AzohyQpgQuk68VJstKAp1oA1UoHYaL3eKzMMU5/ZOLUyftFenA 5J/29tdZ9CK1XSI0c2iOhKt4aXv9ZkiuJUPd33zLlirAB2W5nMqcVjVrx+X6/GhGevuG cXAK4dKtHxYlLiIChcEPqX8H4mLAc+4znn1j5Zc33cfsphl4LWOZi785978KhA0FeocW LCFPfCwbIDzAjXL4ym7bBML/hf7red5pI6Bq73bEzaYrzkyfXfO7HBqHfyXFX0zbsYmm Z5fuHWZ3M2+Lbdr0JvpgoxMUZM2mVviJM0kXh2OgVDB/6+kP5h4is4s8xwr2iW8dWleF hSuw==
X-Gm-Message-State: ALoCoQmoLwUfSlAWD/E2e9aYQ6cVmMNYfOJtguI40LNJGTOTgUPiSa92TarBQ08DtKkQdpPoV572+bUSSKNKvwZKONC+WdsJcA==
X-Received: by with SMTP id c28mr987165pfd.56.1452724466476; Wed, 13 Jan 2016 14:34:26 -0800 (PST)
Received: from [] ([]) by with ESMTPSA id u69sm4805982pfa.61.2016. for <> (version=TLSv1/SSLv3 cipher=OTHER); Wed, 13 Jan 2016 14:34:25 -0800 (PST)
Subject: Re: On email and web security
References: <> <> <> <> <> <> <> <> <> <> <>
From: Doug Royer <>
Organization: http://SoftwareAndServices.NET
Message-ID: <>
Date: Wed, 13 Jan 2016 15:34:30 -0700
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Thunderbird/38.4.0
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg="sha-256"; boundary="------------ms000705030908030803060205"
Archived-At: <>
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: IETF-Discussion <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 13 Jan 2016 22:34:28 -0000

On 01/13/2016 02:33 PM, Matthew Kerwin wrote:
> On 14/01/2016 7:25 AM, "Doug Royer" <
> <>> wrote:
>> On 01/13/2016 08:03 AM, Phillip Hallam-Baker wrote:
>> >>...
>> >> On 01/12/2016 06:27 PM, Phillip Hallam-Baker wrote:
>> >
>> > That is precisely the point. With proxy re-encryption 'recryption' you
>> > do not need to trust the mailing list server. Only the list admin
>> > needs to be trusted with the master decryption key.
>> And you would have to trust the mailing list software verified that the
>> incoming email was encrypted, and by a trusted source, and only accepted
>> encrypted email.
>> If the list server accepted unencrypted email, encrypted it with the
>> lists key, would anyone be able to tell?
> If it comes in plaintext, nothing stops the server (algorithmically or
> morally) from adding a header or some body text that says "I encrypted
> this, but before that it was clear"
> At least then the recipients would know the message they received is the
> one the list server distributed, even if not the original author.

A person that replied to the list message, and had expected the
conversation to be secure, might want to know that part of the
conversation was not secure.

So, I would think that an added header would be a MUST.

In ether case your trusting the list server implementation,
configuration, and site admins and not just the list admin with the list
key as commented above.

It would also be a hole where a subpoena could allow anyone to see the
communications. After decryption, and before re-encryption. For those
that really want a secure list.

In addition, users of the list would have to trust that the
implementation, configuration, or site admins would forward only
encrypted emails to other list members, else its only secure at the
endpoints that happen to use encryption.

How could you tell that the encrypted email sent to a list server did in
fact encrypt the email when it forwarded the email to all recipients?

So, I can't see how anyone that wanted a secure communication could
trust re-encrypted list forwarding. (or at least how I understand this
idea as described in this thread).


Doug Royer - ( / http://DougRoyer.US)