Re: Secure mailing list service using OpenPGP

["William H. Geiger III" <whgiii@xxxxxxxxxx>]

In <199901272040.VAA06373@xxxxxxxxxxxxxxx>, on 01/27/99 
   at 09:40 PM, Edwin Cremer <eddy@xxxxxxxxxxxxxxx> said:

>I have the same problem :-(

>my solution is:
>the server check the signatur and decrypt the message.
>if both ok the server write a new footer with the output of the 
>signcheck and then sign and encrypt the new message. if you have a
>trusted server, the sigcheck is trust ;-) and the members of the list
>don't need all the key's of all other members. it work's fine with
>(nearly) all of pgp version.

Not a bad idea. :)

I have proposed something similar to this for corporate mail servers where
incoming signed mail is verified at the server and stamped before it is
forwarded to the end-users mailbox. This way the end user is relieved from
the work involved in obtaining & verifying keys for incoming mail (this
job would be off-loaded to the resident company crypto zar).

As an added step outbound messages can be auto-encrypted by the server
thus eliminating most of the public key management from the end user (the
end user doesn't even need PGP on his workstation execpt for signing &
decrypting).

I also have been using in my PGP E-Mail implemntaions of doing the PGP
processing as the messages are downloaded by the mail client (decryption &
sig verification) with the results being appended to the bottom of the
messages. Below is an example:

Return-Path: <whgiii@xxxxxxxxxx>
Received: from pompano.pcola.gulf.net (root@xxxxxxxx [198.69.72.14])
	by domains.invweb.net (8.9.1/8.9.1) with ESMTP id SAA17717
	for <whgiii@xxxxxxxxxxx>; Fri, 5 Feb 1999 18:14:56 -0500
Received: from whgiii (dugong19.pcola.gulf.net [205.160.71.82])
	by pompano.pcola.gulf.net (8.9.1a/8.9.1) with SMTP id RAA16408
	for <whgiii@xxxxxxxxxxx>; Fri, 5 Feb 1999 17:14:53 -0600 (CST) Received:
from 100.100.100.1 by whgiii (IBM OS/2 SENDMAIL VERSION 2.03/2.0) id
RAA024.81; Fri, 5 Feb 1999 17:28:03 -0500 Message-Id:
<199902052228.RAA024.81@whgiii> From: "William H. Geiger III"
<whgiii@xxxxxxxxxx> Date: Fri, 05 Feb 1999 17:27:30 -0500
Subject: sigh
X-AutoCrypt: This Message AutoEncrypted With E-Secure v1.1b1
X-Distribution: whgiii@xxxxxxxxxxx
To: whgiii@xxxxxxxxxxx
X-Mailer: MR/2 Internet Cruiser Edition for OS/2 v1.52 b52 
Status:   

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

sigh!!


- -- 
- ---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
- ---------------------------------------------------------------
 
Tag-O-Matic: Rumour: NT means Not Tested

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 5.0i OS/2 for non-commercial use
Comment: Registered_User_E-Secure_v1.1b1_ES000000
Charset: cp850

wj8DBQE2u2JUlHpjA6A1ypsRAhkLAKCDuMwkyC6cvZH2Qz21fZwVAv4AEQCg5gmd
gPVOxAEpHga48o2Hurw0Upk=
=G2FM
-----END PGP SIGNATURE-----
  

--------------------------------------------------------------------
MR/2 PGP Decryption  5 Feb 1999 17:35:01
--------------------------------------------------------------------

Opening file "NUL" type text.
Message is encrypted.
Opening file "WHGIII\36BB7213" type text.
Opening file "NUL" type text.

--------------------------------------------------------------------
MR/2 PGP Signature Check  5 Feb 1999 17:35:01
--------------------------------------------------------------------

Opening file "NUL" type text.
Opening file "WHGIII\36BB7213" type binary.
Good signature made 1999-02-05 21:27 GMT by key:
  1024 bits, Key ID A035CA9B, Created 1998-01-23
   "William H. Geiger III <whgiii@xxxxxxxxxx>"
   "William H. Geiger III <whgiii@xxxxxxxxxxx>"
Opening file "NUL" type text.

-- 
---------------------------------------------------------------
William H. Geiger III  http://www.openpgp.net
Geiger Consulting    Cooking With Warp 4.0

Author of E-Secure - PGP Front End for MR/2 Ice
PGP & MR/2 the only way for secure e-mail.
OS/2 PGP 5.0 at: http://www.openpgp.net/pgp.html
Talk About PGP on IRC EFNet Channel: #pgp Nick: whgiii
---------------------------------------------------------------
 
Tag-O-Matic: I use OS/2 2.0 and I don't care who knows!