If a bug happens in more than a handful of implementations, there’s a good chance the protocol is to blame. Perfect examples of where this emphatically is the c

If a bug happens in more than a handful of implementations, there’s a good chance the protocol is to blame. Perfect examples of where this emphatically is the case is MDC (PGP and Telegram are the only two common protocols in use I can think of where you don’t get a real MAC) and JWT’s alg debacle. Both were obviously ridiculous, and both led to serious vulnerabilities in almost every implementation under the sun. Mind you: with efail, some tools were using GPG directly. GPG produced unauthenticated ciphertext. GPG is also the dominant implementation. If GPG itself does this obviously broken thing, how do you expect third party implementations to get it right?