Fun with Anonymous Recipient

GNU Privacy Guard, or GnuPG has interesting feature called anonymous recipient.
If you know OpenPGP message format enough, you know that the message contains user ID of recipient. So when you receive such message and try to decrypt using your own private key, OpenPGP implementations know which key to use.
This also allows traffic analysis, as perpetrator can skim through the message. He or she may not have any idea what’s included in the message, but it is possible to figure out where the message is intended to.
Anonymous recipient basically masks key ID with 0×0000000. Consequently, recipient will have to try to decrypt message using all the key he or she has, and there’s even possibility that the message is not addressed to that person at all! You’d never know.
You can use anonymous recipient with the following command:

gpg -R keyID1 -ea

Make sure you use upper case R option to specify, instead of lower case. You can mix upper case and lower case option so some of them will have their keyIDs included in the message.
This is useful in the case you want accomplish same type of effect like in E-mail’s BCC feature. Only difference is that you cannot hide the fact that the message is addressed to someone else as well, as you can with E-mail BCC. (BCC addressees are hidden in their headers.)
Only problem with this system is that commercial PGP solutions do not this support, and not sure if it’ll be ever supported. (PGP will treat as if the message is addressed to keyID called 0×00000000, you probably wouldn’t have in your keyring…)
There are some message floating around in my note sometimes using this technique. If I know you use OpenPGP, it may or may not be addressed to you…

By Hideki Saito

In the video game industry for for more than 15 years. Currently working for Nintendo of America Inc. as a Localization Engineer, developing the translation solutions.