Details of Dual-Use

Dual-Use is a simple application developed by Ian Miller and Mr. Tines to convert PGP Encrypt-only and Sign-only keys to a form which can be read by PGP 2.x and clones. This converts the keys to dual-use (i.e. usable for both encryption and signing), as all PGP keys are of this form. The output file contains only the resulting new PGP ASCII-armour blocks. If the original file contains any other text (e.g. e-mail headers) these will not appear in the output file.

Currently it is in beta-test and is available only for Macintosh and PC.

This program is intended to be distributed under the Free Software Foundation's General Public Licence. However as yet it is only in Beta-test, and I do not want distribute source code until it is fully debugged. (The source code also lacks the relevant copyright notices.) The current licence is the GPL except that the following modifications apply:-

• This program may not be used to convert a public key from Sign-only to Dual-use with the intention of using it for encryption without the permission of the user of the key.
• The terms of the GPL relating to source code do not apply. Users are not yet entitled to source code.
• All users must inform the author that they are using the program.
• All problems with program must be report to the author, unless the problem is already in the known bugs list.

Except for the first, these conditions will apply only for the Beta-test period and are imposed to ensure that Beta-testing is as rapid and effective as possible. (Due to lack of Beta testers, the Beta test has been extended indefinitely.) Version 1.0 (with source code and a simple GPL) will released when it has actually been proven in use (if this ever occurs). For the latest news about releases see the release list.

How to run it

This depends on which version you are using:-

• Macintosh
• IBM-compatible PC

To use it on any other machine you will need the source kit which is not available yet.

Use and Abuse

This program is intended to facilitate exchanging encrypted messages between PGP3 and PGP2 users. However it could also be abused to circumvent the use restrictions that the some PGP3 users choose to put on their keys. For this reason using this program to enable encrypting with a Sign-only key is forbidden without permission of the key owner. Converting an encrypt-only key to allow it to check a signature is not forbidden as a valid signature could only exist if owner had converted the secret key. Exposing an invalid signature can never, in the author's opinion, be an abuse of a key. There are no restrictions on its application to secret keys as they are assumed to be under the control of the owner.

How does it work?

All it does is change an single byte in each Key Certificate Block. This byte is the algorithm byte (the11th byte of the block). As a typical key file has contains a single key and the Key Certificate is the first block in the file, this is changes the 11th byte of the unarmoured file. If you have a binary file editor you could do the same operation manually. The values for the algorithm bytes used by PGP3 are as follows:-

• 1 Dual-Use RSA key; Encrypt & Sign (The only type PGP has or recognises.)
• 2 Encrypt-Only RSA key
• 3 Sign-Only RSA key

Dual-use checks the values of all algorithm bytes in all Key Certificates in the unarmoured file, and converts all of the ones with the values 2 or 3 to 1. If it encounters any other values it leave them unchanged.

How can I check the output?

Especially with the Beta-test version where the source code is not available, you may be reasonably suspicious that Dual-Use may be doing something more to your keys than it is documented to do. In fact it is very easy to check what it is doing, especially in the simple case of a block containing a single key. The output block should be identical to the input block except for the following changes:-

• The 15th character on the 1st line of the body of the block should be changed from an 'I' (if an encrypt-only key) or an 'M' (if a sign-only key) to an 'E'.
• The version: line should be changed and should now read "Dual-Use Converter V..."
• The check-sum line (the short line immediately before END PGP line) will have entirely different data.

If there is more than one key in the file there will be other single character changes in the body of the armour, one per key. (Not all the changes are necessarily 'I'/'M'->'E'. The precise valid values have not been confirmed however 'C'/'D'->'B' &'g'/'Y'->'Q' seem likely.) If PGP can read the modified block you can be sure that the check-sum has been recalculated correctly. The change in the version line purely cosmetic.