More private PGP...?

One of the things I've noticed about PGP is that it makes it pretty
obvious that you're sending an encrypted message.  The big

-----BEGIN PGP MESSAGE-----

at the start pretty much gives that away.

In most cases, this is fine, but sometimes it may not be desirable
to make it this obvious.  Sending encrypted messages may call
unwelcome attention to yourself.  Also, some people are experimenting
with packet radio on the amateur bands, and it's not legal to send
encrypted messages there.

What I think would be nice would be an "innocent" mode for PGP
in which it created files which looked like something else.  For
example, what if your encrypted output file looked like:

begin 666 testpat.gif
MI\44:#G4D>QQXR!-M,Z20O1K&5D<U"C;V<J#-I@:ANT,A+>0, 5-4F.X<%MT
M2:V94,K;XE@B?]%IHF+_<VT=U! 3Q;;M-K<QT.N"?%IJTNU!%(KF7K]2^B6+
M;&TTGTULW(4%:F@\&MB^ ^Y5Y\#2A6^*86F-Y"^%J$>WGI%(]#=F]/[LV+&!
M,NH0(!3B35CW#!-Z7"B_L'=-C 8DLB-(J R"3?EE9<.>QE4Y?T$66IA7B@W?
end

This will be recognizable, if you've seen many, as a uuencoded file,
a common encoding for non-ascii files.  The header line suggests
that it is a graphics file.  Tons of these types of files are sent
across email networks every day.  Sending your encrypted messages
in this form would give you a lower profile.

Still, if someone goes to the effort to uudecode your message,
and examines the resulting file, it will be obvious that it's not
a GIF file because it lacks the proper headers.  Instead, with
the current PGP implementation it will be obvious that it is in
fact a PGP file, because the header format matches the PGP spec.

Again, I think it would be better if PGP in this mode were able to
produce a file without headers which will give away what it is.  Even
better would be the ability to mimic headers of some other types
of files, such as the .ZIP, .ZOO, or Unix "compress" format which are
often used in binary files people mail around.

Another thing that I think is kind of bad about PGP in the context
of avoiding traffic analysis is that it puts the key ID of the
destination person in the header.  There was some discussion during
development of a mode in which no key ID information would be in the
header; the only way you'd have of knowing if the message was for
you was to try decrypting it.  (There is a checksum which is used
internally to tell if the decryption was done with the right key.)
This way you could broadcast messages to some group, and no one could
know which person in the group you were sending to.

These "anonymous destination" messages could be encoded with a key
ID of zeros, and the PGP software could easily be modified to let
the user try a decryption on such a message, reporting success or
failure.

How useful do these kinds of features seem to people?  Would they
really be helpful or is this just paranoia?

Hal
74076.1041@compuserve.com

>One of the things I've noticed about PGP is that it makes it pretty
>obvious that you're sending an encrypted message.  [...]  Sending
>encrypted messages may call unwelcome attention to yourself.

First, let me get on record as saying that Hal's "innocent mode" is a
good idea that should be implemented.

But it's not really a good long-term solution from a social point of
view.  Encrypted traffic should become the norm, not the exception.
Flagging that you're sending encrypted traffic should be encouraged.
When questioned about this, people should respond in shocked tones
"What do mean?  Aren't you encrypting _your_ email?" and then proceed
to suppress gentle laughter at them when they say no.

When it's cool to encrypt, only the uncool will be plain.

So, then, more peer pressure!  Consider someone asking you about your
encrypted mail to be an opportunity to start a conversation about
their position on personal privacy.  When your sysadmin asks why your
mail can't be read, tell him you are defending your privacy and ask if
there is any problem with that.  Then, when the sysadmin puts in a
filter for PGP traffic, use innocent mode.

>Another thing that I think is kind of bad about PGP in the context
>of avoiding traffic analysis is that it puts the key ID of the
>destination person in the header.  

Absolutely.  Ditto for signatures.  Both should be able to be
selectively removed.  In any case, it should be possible to have
nothing appear on the outer envelope.

Another feature for PGP would be automatic message padding.  To
properly do a mix you need to quantize the message lengths.  If PGP
were to automatically pad with random data, it would save a lot of
integration work for the mix.  PGP already has a random number
generator, after all.

Eric