Does anybody really bother checking the PGP source code?
Yes! I have personally tested (in PGP v5.0i) the implementation of DES, CAST, IDEA, MD5, SHA-1, RIPE-MD against test vectors. I have also tested the code used for DSS signature generation against the test vectors provided in [FIPS186] which testifies that the Big Number library code is working correctly. I have tested the output from the RNG used within PGP as detailed in section 7.7. I would, of course, conduct the above tests on other similar security packages (S/MIME implementations for example) – but it just isn’t possible. From personal experience, more people compile, inspect and test the source code than one might navely believe. From my involvement with ScramDisk, I note that out of the user base (which we estimate to be around 20,000), I have received e-mails from in excess of 40 individuals asking sometimes very technical questions about the source code. PGP is used by many more people than ScramDisk, so one can predict that the number who inspect the source code of PGP is co
