Re: opgp91 uploaded - version d :)

[nospam-seesignature@xxxxxxxxxx]

On Mon, 30 Mar 1998, Hal Finney wrote:

> This is a remarkable accomplishment!  OpenPGP compatible encryption,
> decryption, and signatures in under 6000 lines of C code, making use of
> standard libraries like SSLeay.  Those who are reluctant to wade through
> the 100000+ lines of PGP 5.X may find this implementation easier to
> digest.  I want to congratulate tzeruch for producing this implementation
> so quickly, and thank him for his interoperability testing with PGP 5.X.
> 
> Hal Finney

Not so fast, now 0.91d (a pre 0.92) is there.  Our T1 went down, and I
found a few small problems, but have full V4 signatures in one pass form
(I merged routines so it is smaller too).  There is always 1 more bug.
But it is easier to find in fewer lines and usually something stupid I did
recently.  But my TODO list has no more features (unless the spec
changes), and there isn't too much more to clean up.

A fixed test suite will be up tomorrow (My 75Mhz 486 laptop is fast enough
for development, but not to generate the test cases, and I don't want to
upload using a modem).

It also wasn't that quickly - I already had a 2.6.2 lib (my minipgp
directory originally). The first version actually predated the scanned
code (I has all but S2K for the things that were turned on, and bought the
5 volumes which now have post-it notes every few pages when the scanning 
effort seemed stopped at 95%).

Also remember I am leaving it to pgpk to handle keyrings and trust, and I
don't do packet parsing.  Someone else can do a shell script or GUI or
something else as a wrapper.  I use the routines as a general crypto
library, but it is nice to be compatible with an application.  But for PGP
internals, I think it is a good reference.  Now that it works.

After the scanned code was available, I could more easily turn things on,
so I could verify more things ( f(f**-1(x))=x, f and f**-1 being different
implemntations if possible).

Now that I have a real (or sometimes surreal) spec, it is easier.

But part of the effort was to produce a cleaner reference source - the
S2Ks get/put for example are mirror images, and except for the hashing,
monolithic.

--- reply to tzeruch - at - ceddec - dot - com ---