From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Werner Koch <wk@gnupg.org>, Vincent Breitmoser <look@my.amazin.horse>
Thread-Topic: [openpgp] Issuer Fingerprint
Thread-Index: AQHRxVv+XkgLTKRZjUCqSa/FVCgLe5/oG7mAgADZDYD//zg6gIAA326vgAT9/1Y=
Date: Fri, 17 Jun 2016 19:02:05 +0000
Message-ID: <9A043F3CF02CD34C8E74AC1594475C73F4CA3941@uxcn10-5.UoA.auckland.ac.nz>
References: <87mvmp5rmi.fsf@wheatstone.g10code.de>
 <CABtrr-Vrv-S_2htPECqLR+Butqr9GzwvPaXfqEyW2fBRW__o_w@mail.gmail.com>
 <87mvmnyknu.fsf@wheatstone.g10code.de>
 <20160614132705.GA28122@littlepip.fritz.box>,
 <8760tbygok.fsf@wheatstone.g10code.de>
In-Reply-To: <8760tbygok.fsf@wheatstone.g10code.de>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/openpgp/qG0TFy4wmrEDvzFP5X1YySR5tpA>
Cc: "openpgp@ietf.org" <openpgp@ietf.org>, Joseph Lorenzo Hall <joe@cdt.org>
Subject: Re: [openpgp] Issuer Fingerprint
Precedence: list

Werner Koch <wk@gnupg.org> writes:=0A=
=0A=
>I strongly disagree for OpenPGP.  The MUSTs, SHOULDs, and MAYs have been=
=0A=
>carefully designed and implemented in a sensible way.  Thus there are no r=
eal=0A=
>world interoperability problems between OpenPGP implementations.=0A=
=0A=
Uhh, I'll have to disagree (strongly) with that, perhaps from the point of =
GPG=0A=
this is true since it's the de facto reference implementation that everyone=
=0A=
makes their code compatible with, but when you need to interop across non-G=
PG=0A=
implementations it can get pretty hairy, I've had to reverse-engineer sourc=
e=0A=
code and create instrumented versions of other apps that hex-dump data so I=
=0A=
can see what they're doing.  I've also had to do that with GPG on a couple =
of=0A=
occasions where the spec was unclear on which data needed to be processed i=
n=0A=
which way.  I assume that a lot, if not all, the code out there is written =
to=0A=
be compatible with the GPG de facto profile, in the same way that SSH code =
is=0A=
written to be compatible with the OpenSSH (server) and Putty (client) de fa=
cto=0A=
profiles.=0A=
=0A=
Peter.=