I noticed that the implementation of DigestInputStream does not feed skipped-over bytes to the message digest. The specification is silent on this, and I'm not sure if this a specification deficiency or an implementation bug. -- Florian Weimer / Red Hat Product Security