News for hackers. Stuff that matters.
Re:Schleuder: A GPG-enabled mailinglist with remailing-capab... by dijit on Tuesday July 25, 2017 @03:56PM (#14851328)
Kinda cool but it depends on you trusting the central mailer since it does decryption and reencryption.

I suppose if you know about that then it is ok.

The benefit of this approach over the alternative (making people encrypt and sign with a lot of keys) is that once received, the content does not give away the key names of the other mailing list members.

Re:Schleuder: A GPG-enabled mailinglist with remailing-capab... by dice on Tuesday July 25, 2017 @04:50PM (#14851738)
The other benefit is that users can send to the list without the (possibly huge) administrative burden of getting a full and complete list of public keys for all subscribers. A similar setup is used for e.g. the (linux-)distros lists[0] at openwall for discussing embargoed security issues.

0: http://oss-security.openwall.org/wiki/mailing-lists/distros

Re:Schleuder: A GPG-enabled mailinglist with remailing-capab... by o- on Wednesday July 26, 2017 @03:06AM (#14854165)
In theory there are alternatives where you do not need to trust the server. The keyword is proxy re-encryption (e.g. [SELS]).

On the other hand schleuder exists today and can be used by normal people (for example without having a custom private key per list, as you need afaik for [SELS]).

The other often overlooked fact about schleuder is that it's also a re-mailer. You can use it in a one-to-many setting, where the external party does only know the cryptographic key and email address of the list and a group of people can communicate with this person using schleuder as the proxy. This is a great alternative to shared mailboxes and a feature that is probably impossible with proxy encryption.

[SELS] https://slagell.info/Adam_J._Slagell/Past_Projects_files/khu...

Re:Schleuder: A GPG-enabled mailinglist with remailing-capab... by dsacco on Tuesday July 25, 2017 @04:51PM (#14851744)
> once received, the content does not give away the key names of the other mailing list members

This doesn't present a problem, because you can construct anonymous group signature schemes.

Re:Schleuder: A GPG-enabled mailinglist with remailing-capab... by cvwright on Tuesday July 25, 2017 @05:08PM (#14851869)
> because you can construct anonymous group signature schemes

Heh. In practice this is true, but only for sufficiently advanced values of "you". I certainly wouldn't feel comfortable attempting such a thing without consulting a real cryptographer.

Re:Schleuder: A GPG-enabled mailinglist with remailing-capab... by dsacco on Tuesday July 25, 2017 @05:14PM (#14851915)
Absolutely agreed, I was speaking as a matter of theory :)
Re:Schleuder: A GPG-enabled mailinglist with remailing-capab... by lgierth on Tuesday July 25, 2017 @04:46PM (#14851708)
> The benefit of this approach over the alternative (making people encrypt and sign with a lot of keys) is that once received, the content does not give away the key names of the other mailing list members.

The other benefit is that membership management is a lot easier. Usually the first time you tell members to add or remove a key, things start falling apart quickly. Schleuder makes that easy.