How to communicate by email with forward secrecy and deniability?

Question

My correspondents and I would like to communicate privately by email. We used to employ PGP but that might have been shooting ourselves in the foot. PGP doesn't have forward secrecy. If any of our private keys are ever compromised (by law, hacking, or rubber hose), then all our past conversations can be immediately decrypted. And our signatures shown in court.

So we switched to instant messenger conversation with Off-the-Record (OTR) messaging because it gives

Encryption

No one else can read your instant messages.

Authentication

You are assured the correspondent is who you think it is.

Deniability

The messages you send do not have digital signatures that are checkable by a third party. Anyone can forge messages after a conversation to make them look like they came from you. However, during a conversation, your correspondent is assured the messages he sees are authentic and unmodified.

Perfect forward secrecy

If you lose control of your private keys, no previous conversation is compromised.

As explained eloquently at http://www.cypherpunks.ca/otr/otr-wpes.pdf

Is there anything like that for email?

Answer 1

OTR can provide forward secrecy because both partners create fresh ephemeral (one-time-use) keys, which are discarded afterwards, so they can't be recovered by later attackers.

The long-term public keys are only used to authenticate them, to avoid any man-in-the-middle attack.

For offline communication like e-mails this is not easily possible, since the receiver can't contribute an ephemeral key, as already mentioned by CodesInChaos.

If you can live without the forward-secrecy (only the other three properties), you can use long-term Diffie-Hellman keys, do an offline DH-exchange with them and derive from the result (preferably with some salt-like entropy input so not each mail has the same) symmetric keys for both encryption and MAC. The receiver then knows that you and her are the only ones which knew the DH result, and thus the encryption and MAC keys, so only one of you both can have sent this. But she also could have created the message herself, so you have deniability, too. _{Thanks to CodesInChaos for the comment.}

If you can beforehand (maybe over an OTR-chat) consent with your partner about a symmetric key, you can simply use symmetric encryption and a MAC in your email, and get the encryption, authentication and deniability (the receiver could have created the same message, as she knew the same key). If both partners delete the symmetric key after the sending/receiving of the message, it is also forward-secret. But it still is not really an offline communication as the online key exchange is needed.

Of course, we could stretch a protocol like OTR over a message exchange by email. But then both mail clients (or some other software which handles the protocol) would have to store crypto status between the individual messages, which also harms the "perfect forward secrecy", since this status could be potentially recovered. (You could switch the key with each message, and discard old ones as soon as you receive the next key from your partner, and send a new message after any important message to limit the time keys have to be hold in storage.)

The paper you linked in section 6 ("EMAIL") mentions this possibility, as well as a "Ring signature", which provides slightly smaller guarantees.