Re: [Medup] On Extra Keys in pEp (Neal H. Walfield)

[Metin Savignano <[e-mail]>]

Hi everyone,

I hope it's okay when I jump in to share my thoughts.

>> [snip]
>> 
>>    // Ensure we don't encrypt to extra keys if this is a non-org account
>>     if (!(target_id->flags & PEP_idf_org_ident))
>>         extra = NULL;
>> 
>> [/snip]
> 
> Can you explain what a non-org account is, please.
> 
>> Any thoughts on that approach?
> 
> I see two aspects to this problem: when internal users (e.g.,
> employees) send an encrypted message, and when external users send an
> encrypted message (e.g., customers).
> 
> When an internal user sends a message, they can be trained to accept
> the additional key.  That's easy.
> 
> But,when a customer sends an encrypted message to an employee, do they
> automatically use the additional key?  If they have to opt in, how
> does an organization decrypt messages for employees who are sick or on
> vacation?

Neal definitely has a valid point here. 

However, I’d like to make one step back and ask: why do we need the extra key for that scenario?

The reason I’m asking is that this requirement is not new at all, and the solution to it that I am aware of is that the organization must keep a copy of the private key of all its users.

That’s why it's recommended to split keys between signing keys and encryption keys: so the organization can keep a copy of the private key, but not of the signing key, which allows it to decrypt messages, but not to step into the user’s identity.

So I think the solution should be to allow the organization to get the private key, shouldn’t it? Or am I missing something here?

Thanks
Metin