Comparison of GnuPG & NAI/PGP features.

[Werner Koch]

On Fri, 7 Jan 2000, Simpson, Sam wrote:

> AFAIK the NAI distribution is just a build of the normal files. 
> You can't do a byte-by-byte comparison of the executable though
> because VC++ includes date/time stamps etc.

This should not be a problem if you know the excat version of all
tools.  It is possible to ignore those timestamps when comparing the
objects and executables.  The gcc build process does the same.

Has this ever been done or is the process of creating the PGP
executables supervised by independent experts and if, who is it and
where can I get there certificate?

<paranoid-mode> Why are employees of NAI suggesting to better use 
the original version and not the international (scanned) version 
(happend at the Systems/Munich this fall)?
</>

> A sexy feature, to be sure.  I know the NAI/PGP Windows version
> also includes this feature, but I'm not sure about the UNIX
> versions...

I have not seen something like this when I installed it on a
MS-Windows box.  Maybe they silently installed this device driver;
however, I was not asked to reboot :-)

> This is a "double-width" version of SHA-1, as per Hash Algorithm
> ID 4 in [RFC2440].  PGP v5.x allowed the verification of

This is not an OpenPGP algorithm.  It is marked as reserverd for 
experimental use and there is not description available.



-- 
Werner Koch at guug.de           www.gnupg.org           keyid 621CC013
  
     Boycott Amazon!  -  http://www.gnu.org/philosophy/amazon.html