This is version 0.1 of the SecureMailinglist howto.

Your group has a working mailinglist setup and now you all want to secure this mailinglist with GnuPG. You are ready to install some programs on your computer.

Of course, you need GnuPG. The official GnuPG does not contain support for the "multikey"-feature I have hacked. Concluding, you need an unofficial, patched version of GnuPG. There are several ways to get a patched GnuPG:

There are several mail user agents, which support GnuPG. Lets say, you've decided for Mozilla Thunderbird and installed it. Thunderbird does not support GnuPG out of the box yet; you need to install the Enigmail extension as well.

We now assume that an Enigmail enabled version of Thunderbird is properly installed.

IMPORTANT NOTE: duo to a bug in gpg4win/Enigmail the following step is necessary at the moment: by default, Enigmail uses the gpg.exe program found in e.g. "C:\Programme\GNU\GnuPG\pub\gpg.exe" - this needs to be changed to "C:\Programme\GNU\GnuPG\gpg.exe" - depending on where exactly GnuPG has been installed. It's important to remove the "\pub" part. This can be adjusted in the Enigmail preferences.

Thunderbird does it for you. [...]

Don't forget to upload your key to a keyserver or make it otherwise accessible to the list members (for example by putting it on your webpage)

The list admin needs your public key "fingerprint" in order to be able to setup the key references accordingly. Thus: send your public key to the list admin. Then arrange a meeting with the list admin so you can give him/her your keys fingerprint.

The list admin will update the key references and send the updated key to the mailinglist, expecting all the mailinglist members to (re-)import the updated key.

In contrast to other solutions for encrypted mailinglists, the multikey-approach does NOT relieve the mailinglist members from the task to setup their personal web-of-trust (which can be considered a good thing!). This means that the members need to import keys from all the other members and establish trust relationships by comparing fingerprints and signing keys. See FIXME for more information on this topic.

After having imported the updated multikey belonging to your mailinglist and after having done basic configuration of your mail user agent, everything should be ready for some test e-mails.

Note that the multikey-enabled GnuPG does NOT simply encrypt to everybody referenced by the multikey. It does only encrypt to the referenced keys IF you have properly imported the referenced keys into your keyring AND succesfuly established trust relationships to the referenced keys. If one of these two conditions does NOT hold, the key reference in question is silently ignored by GnuPG.