Re: [openpgp] Fingerprints

[Daniel Huigens <[e-mail]>]

Hi Neal and Derek,

On Friday, November 25th, 2022 at 17:22, Derek Atkins wrote:
> Sorry, I don't see the issue here? Both versions here are using "the
> 256-bit SHA2-256 hash of".
> 
> So where is the issue? What am I missing?

It makes it harder to know from the fingerprint what the key version is.
And when looking up keys it's nice to know the version before comparing
fingerprints - then you can also ignore all keys with a different
version without even looking at (or computing, if you haven't yet)
the fingerprint bytes.

On Friday, November 25th, 2022 at 17:02, Neal H. Walfield <[e-mail]> wrote:
> Second, we could just make the version number part of the fingerprint.
> That is, the fingerprint could be defined as the concatenation of 6
> (assuming we do s/v5/v6/) plus the 256-bit SHA2-256 hash.

I would be in favor of always specifying the key version and fingerprint
together. The one worry I have about making it actually part of the
fingerprint is that if people are doing manual fingerprint verification
(which, I'm the first to say they shouldn't, but..) then the leading
constant 6 may make it easier to make two fingerprints appear "similar".

We could simply state that v6 key fingerprints should be presented as
6:xxxx..., for example, to make it clearer what's going on. That way,
we can maybe also roll it out for v4 fingerprints, and always show
v:fingerprint without causing too much confusion, hopefully.

Best,
Daniel