Note that you should not download by ID fingerprint.

svn:r5634

diff --git a/doc/dir-spec.txt b/doc/dir-spec.txt
index aaecac08b24757e842b0d27ed5db1e1b4e9ff95a..65b2ddb878eabd8ae8bb2d37cd40dbc6542d7808 100644 (file)
--- a/doc/dir-spec.txt
+++ b/doc/dir-spec.txt
@@ -305,10 +305,15 @@ $Id$
    fingerprint of <F> should be available at:
       http://<hostname>/tor/server/fp/<F>.z
 
-   The most recent descriptors for servers with fingerprints <F1>,<F2>,<F3>
-   should be available at:
+   The most recent descriptors for servers with identity fingerprints
+   <F1>,<F2>,<F3> should be available at:
       http://<hostname>/tor/server/fp/<F1>+<F2>+<F3>.z
 
+   (NOTE: Implementations SHOULD NOT download descriptors by identity key
+   fingerprint. This allows a corrupted server (in collusion with a cache) to
+   provide a unique descriptor to a client, and thereby partition that client
+   from the rest of the network.)
+
    The descriptor for a server whose digest (in hex) is <D> should be
    available at:
       http://<hostname>/tor/server/d/<D>.z