Subject: purpose of the checksum?

From: "vedaal" <[email-masked]>
Date: Wed, 4 Apr 2001 15:30:52 -0400

-----BEGIN PGP SIGNED MESSAGE-----

The checksum of a pgp message block, can be deleted together with the
footer, from any pgp signed/encrypted/signed & encrypted message without
affecting decryptability or verifiability.
{as long as the pgp footer is deleted together with it.  if only the
checksum is deleted without the footer, there will be a message of <ascii
armor incomplete>}

As this is so, what is the purpose of the checksum?

vedaal nistar

- ---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.237 / Virus Database: 115 - Release Date: 3/7/01

---

From: "Michael Young" <[email-masked]>
Date: Sat, 7 Apr 2001 19:31:21 -0400

-----BEGIN PGP SIGNED MESSAGE-----

>As this is so, what is the purpose of the checksum?
- From context, I gather you're talking about the ASCII armor checksum,
not the encrypted checksums inside key or session key packets?

The purpose is simply to reduce transmission accidents, which is the
point to armoring in general.  As you observed, the (dearmored) PGP
packets are complete without it, and can be properly interpreted.  An
OpenPGP implementation certainly *could* insist on it being complete.

Note that the armor checksum is done on the entire *encoded* message,
not the plaintext, so it does not deter malicious alterations.  The
OpenPGP draft now includes a modification detection code to address
malicious alteration or truncation.