The critical point is specification vs. implementation. Any difference creates a loophole which can be abused.