Nope, that Eve can intercept a copy of GPG-encrypted mail and extract plaintext To, From, Title, time, with some luck also some info about sender's IP and software, plus all info that is in recipient's and possibly sender's public key (this usually covers full, true name, work, approximate location and alternative e-mails, often also a photo). What you mention is an orthogonal problem.
Ann has a key. Ann must know that the key is Bob's key. If Ann isn't sure that the key is Bob's key there's a bunch of bad stuff that might happen.
So now Eve can get the metadata, and be pretty sure that the stuff sent to Bob actually is sent to Bob, and not someone else, because it's encrypted with Bob's public key.
Eve can't decrypt anything. But my post wasn't about Eve getting any content, it was about Eve getting metadata that's cryptographically tied to an identity.
The connection between key and identity doesn't have to be public.
The point is that the headers of an email aren't encrypted (otherwise it couldn't be delivered). In the headers is who the message is to, who it's from, the subject, the time, and if you're lucky, the ip of the sender. All of that isn't encrypted and free for the taking and has nothing to do with the id attached to the key used to encrypt the content.
Comments
Nope, that Eve can intercept a copy of GPG-encrypted mail and extract plaintext To, From, Title, time, with some luck also some info about sender's IP and software, plus all info that is in recipient's and possibly sender's public key (this usually covers full, true name, work, approximate location and alternative e-mails, often also a photo). What you mention is an orthogonal problem.
Hang on, I'm a bit confused here.
Ann has a key. Ann must know that the key is Bob's key. If Ann isn't sure that the key is Bob's key there's a bunch of bad stuff that might happen.
So now Eve can get the metadata, and be pretty sure that the stuff sent to Bob actually is sent to Bob, and not someone else, because it's encrypted with Bob's public key.
Eve can't decrypt anything. But my post wasn't about Eve getting any content, it was about Eve getting metadata that's cryptographically tied to an identity.
Where am I going wrong?
The connection between key and identity doesn't have to be public.
The point is that the headers of an email aren't encrypted (otherwise it couldn't be delivered). In the headers is who the message is to, who it's from, the subject, the time, and if you're lucky, the ip of the sender. All of that isn't encrypted and free for the taking and has nothing to do with the id attached to the key used to encrypt the content.
Right, the metadata is always public.
Without strong encryption you have metadata that can be tied to an identity using statistics with enough data.
With strong encryption you have metadata that can be tied to a key and an identity using statistics with enough data.