This feature allows members of a party (/group/team) to decrypt a message send to a party certificate. Each member decrypts the message with their own private key. No secrets are shared.
A party certificate is a primary key which stores the party's members fingerprints in the user ID signature.
Current Specification
- Primary *PGP certificate.
- Key flags (see LibrePGP 5.2.3.23):
- First octet: 0x01 (cert)
- Second octet: no flags set
- Third octet: 0x01 (party)
- Exactly one user ID packet which represents the party name
- User ID self signature has a non-human-readable notation sub-packet with
- name="party@gnupg.org" and
- value=<Fingerprint1_version><Fingerprint1><Fingerprint2_version><Fingerprint2>...<FingerprintN_version><FingerprintN> with N <= 250
- If the party key has no members: value=-
- No sub keys are allowed
- Avoid duplicate fingerprints in the memberlist
Options
- --member <FPR>: specifies the fingerprint of a member. This can be used to specify members during the key generation of a party certificate with --quick-gen-key or when maintaining a party certificate (see Commands). This is used similar to the --recipient option.
- --list-option show-members: Show party members in the keylisting with gpg --list-keys.
- export-options export-party: Include all party members when exporting a party certificate.
Commands
- --add-members <partykey_fpr>: Adds members specified with --member <fpr> option to the party key with partykey_fpr.
- --change-members <partykey_fpr>: Change the member list of the party key with party_fpr to the members specified with the --member <fpr> option
- --remove-members <partykey_fpr>: Remove members specified with --member <fpr> option from the party key with partykey_fpr
This should also be implemented for gpgme.