GPG ignores whitespace at line end

Hello All,

There's a funny thing with GPG i just discovered for myself. If you
create a message "foobar", sign it with gpg --clearsign, then add some
whitespace to signed message after foobar, signature is still good.
Tested with gpg 1.2.3 and 1.2.5.

Is this an intended behaviour? If it is, where should i look for more
info (yes, i already searched through the google =).

Regards,
Artiom

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

artiom@phreaker.net (Artiom) writes:

>There's a funny thing with GPG i just discovered for myself. If you
>create a message "foobar", sign it with gpg --clearsign, then add some
>whitespace to signed message after foobar, signature is still good.
>Tested with gpg 1.2.3 and 1.2.5.

>Is this an intended behaviour? If it is, where should i look for more
>info (yes, i already searched through the google =).

This is intended behavior. When you use "--clearsign", that
specifies textmode. In textmode, the line endings are put into
canonical for when creating the signature and when verifying the
signature. There is control info in the signature which indicates
that textmode was used, so that the verification will also use it.

Part of the canonification of line endings is to strip trailing
spaces.

Your gpg man pages probably say something about this.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.3.91 (SunOS)

iD8DBQFBqywEvmGe70vHPUMRAi+GAKD3Ge0hlXYaqr5cOQ+Jt4 DXq5qZSwCg8aAX
n2yZFT/IfTd0TZsk/z8ZZMI=
=OAQM
-----END PGP SIGNATURE-----

Neil W Rickert <rickert+nn@cs.niu.edu> wrote:

> artiom@phreaker.net (Artiom) writes:
>
>>There's a funny thing with GPG i just discovered for myself. If you
>>create a message "foobar", sign it with gpg --clearsign, then add some
>>whitespace to signed message after foobar, signature is still good.
>>Tested with gpg 1.2.3 and 1.2.5.
>
>>Is this an intended behaviour? If it is, where should i look for more
>>info (yes, i already searched through the google =).
>
> This is intended behavior. When you use "--clearsign", that
> specifies textmode. In textmode, the line endings are put into
> canonical for when creating the signature and when verifying the
> signature. There is control info in the signature which indicates
> that textmode was used, so that the verification will also use it.
>
> Part of the canonification of line endings is to strip trailing
> spaces.

All true, but just for completeness: --clearsign disregards both
spaces and tabs at the end of the line. The main historical reason
for this is that email gateways sometimes did abusive things to line
endings.

David