Subject: Re: signature woes and reconciliation, examples appreciated

From: [email-masked]
Date: Fri, 8 Aug 2003 10:46:59 -0500

Adding "...in the same hash context" would probably be enough, as hash
contexts are explained in the key stretching section.  Of course, adding
pseudocode would not hurt.

                      "Hal Finney"                                                                                                
                      <[email-masked]>             To:      [email-masked], [email-masked]                            
                      Sent by:                     cc:                                                                            
                      owner-ietf-openpgp@m         Subject: Re: signature woes and reconciliation, examples appreciated           
                      ail.imc.org                                                                                                 

                      07/31/2003 07:15 PM                                                                                         

> From: [email-masked]
> I recently ran into trouble trying to calculate the hash needed to
> verify a GnuPG (1.2.2) v3 DSA one-pass signature with my pet Python
> hopeful-implementation-to-be.

I've had someone else run into the same problem interpreting this part of
the spec.  The language about "first you hash this, then you hash that,
then you hash this other thing" seems very natural to me (I wrote much of
it after all), working with a programming interface where you pass data
incrementally into a hash context object.  But other people interpret
it as you did, that you produce a hash of the first part, then a hash
of the second part, then a hash of the third part, and somehow combine
these hashes together to get the final signature.

Hal Finney