Hi Jan,
On 22 Mar 2017, at 01:40, johny johny@neuromancer.sk wrote:
Hi all, I'm currently working on my GSoC proposal for the GNU Mailman project, which aims to implement encrypted mailing lists. I noticed that Tor project uses Mailman and has a few private lists as well. I think that Tor project's private lists might be a great example that could use such encrypted lists.
This sounds like a great proposal, but we've just implemented Schleuder.
Can you tell us how this would be different from Schleuder?
I've CC'd Silvia, who did the implementation, and might be able to provide a more detailed response.
What requirements would Tor project have of such encrypted mailing list? This would help me better understand potential uses of encrypted mailing lists in a real environment.
My proposal uses PGP/MIME. A short description follows:
It establishes a list keypair which subscribers use to encrypt their messages with. A user needs to present a PGP public key on subscription which will be later used to encrypt messages from the list. List owner moderates the list and accepts users subscription. User has to prove ownership of the key by signing a confirmation token. Subscriber then sends messages encrypted with list key and signed with the one he subscribed with. He receives messages encrypted to his key and signed by the original author as well as the list itself. Commands will require signature and confirmation too.
A more detailed proposal can be found in the links below.
-Jan
(Please don't put lines of dashes in the middle of your email. Some people use broken mail clients that cut off any text after a line of dashes.)
T
-- Tim Wilson-Brown (teor)
teor2345 at gmail dot com PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n xmpp: teor at torproject dot org ------------------------------------------------------------------------