Re: [openpgp] Fingerprints

["Neal H. Walfield" <[e-mail]>]

On Mon, 28 Nov 2022 15:40:19 +0100,
Neal H. Walfield wrote:
> On Fri, 25 Nov 2022 18:14:33 +0100,
> Daniel Huigens wrote:
> > On Friday, November 25th, 2022 at 17:02, Neal H. Walfield <[e-mail]> wrote:
> > > Second, we could just make the version number part of the fingerprint.
> > > That is, the fingerprint could be defined as the concatenation of 6
> > > (assuming we do s/v5/v6/) plus the 256-bit SHA2-256 hash.
> > 
> > I would be in favor of always specifying the key version and fingerprint
> > together. The one worry I have about making it actually part of the
> > fingerprint is that if people are doing manual fingerprint verification
> > (which, I'm the first to say they shouldn't, but..) then the leading
> > constant 6 may make it easier to make two fingerprints appear "similar".
> > 
> > We could simply state that v6 key fingerprints should be presented as
> > 6:xxxx..., for example, to make it clearer what's going on. That way,
> > we can maybe also roll it out for v4 fingerprints, and always show
> > v:fingerprint without causing too much confusion, hopefully.
> 
> I understand the motivation, but I'd rather hide this information;
> it's an implementation detail that users don't need to know about.
> 
> If we start showing users 4:xxx, they are going to be confused.
> Moreover, old software won't understand what to do with it.

Although I hope the different implementations agree on how to present
fingerprints, the question of how that is done is out of scope for
this discussion.  As per the draft:

> 14.6.  Fingerprint Usability
>
>    this document does not attempt to
>    standardize any specific human-readable form of v5 fingerprint for
>    this discouraged use case.

Neal