Subject: Minor clarification for fingerprint calculation

From: David Shaw <[email-masked]>
Date: Fri, 7 Mar 2003 22:17:23 -0500

Section 11.2 reads:

   A V4 fingerprint is the 160-bit SHA-1 hash of the one-octet Packet
   Tag, followed by the two-octet packet length, followed by the
   entire Public Key packet starting with the version field.

This is a bit misleading, as the "one-octet Packet Tag" is not the
actual packet tag of the public key in question, but rather an old
style packet tag with the length-of-length set to 1 (for a two byte
length).  In other words: 0x99.

I've seen this line misunderstood a few times, with the resulting
incorrect fingerprints which were based off of the actual packet tag
of the public key.

I believe this line would be better as:

   A V4 fingerprint is the 160-bit SHA-1 hash of the octet
   0x99... (etc)

Note that the example following the text, as well as the references in
5.2.4 (for general hashing of a public key), and an additional
reference in 11.2 as part of the discussion of subkey fingerprints all
use 0x99.

David

---

From: Jon Callas <[email-masked]>
Date: Thu, 20 Mar 2003 10:19:38 -0800

>  A V4 fingerprint is the 160-bit SHA-1 hash of the octet

Done.

    Jon

---

From: "Michael Young" <[email-masked]>
Date: Fri, 21 Mar 2003 11:52:26 -0500

David's requests for clarifications leads me to ask a historical
question... why were the constants in the hash material chosen to be
the old-style packet headers with length-of-length set inconsistently
with their use here?  In the following excerpt, the natural
length-of-length would be 2 (4-byte length to follow) rather than 0
(1-byte length to follow).  Was this a mistake, an intentional
deviation to prevent some perceived attack, a strange artifact of the
PGP5 implementation, or something else?  (This is just a curiosity,
not a request that it be documented.)

>    without any header. A V4 certification hashes the constant 0xb4 for
>    user ID certifications or the constant 0xd1 for User Attribute
>    certifications (which are old-style packet headers with the
>    length-of-length set to zero), followed by a four-octet number