Sounds like it would be a good idea for authors to start providing checksums for their papers

Right it’s not insurmountable, authors can publish public keys and sign the files - it’s a UI/UX problem like everything else in crypto.

Keybase makes it fairly easy, but people still have to learn what it means and why it’s trustworthy - my bet is things don’t change, there is a small percentage of people who understand how to verify the source, and the general population who either believes anything or nothing.

In the context of scientists and professionals tho maybe it is achievable to do some outreach and get people on eg keybase, something user friendly

Most people I've been advocating Keybase to, just assumed it's yet another place where you create an account and hence you must trust them (now owned by zoom, boo-hoo).

I found it well explained etc, but it's hard to reach everybody.

Lets say Zoom wanted to sell Keybase. Lets say they wanted to sell it to someone like myself, who would run it in a non profit like a utility, similar to Let's Encrypt. Lets say I'd then integrate it with Stripe Identity and gov IDP providers (US: login.gov, UK: gov.uk verify). This would then allow you to publicly sign damn near everything with an identity you could choose to (but not be required to!) connect to your IRL identity.

That sounds what's needed, an extension of your IRL identity with top notch tooling to manage signatures (what PGP/GPG should've been) instead of docusign and similar that are charging an arm and a leg to "sign" PDFs with generated initials and signatures. We could go further; the signature is human readable in the rendered PDF (or whatever), and the Internet Archive takes a snapshot as an oracle notary when published, similar to Certificate Transparency for certs, but for all sorts of digital artifacts (the Internet Archive's snapshots have been used by a court of law for evidence authentication, so it's a trusted system [1]).

It ain't hard, it's just work.

[1] https://www.theregister.com/2018/09/04/wayback_machine_legit...

Unfortunately that's not practical. When you download from a uni gateway, pdfs are often auto-watermarked with the source. That way the authors have no idea what checksum you see. And the places which don't do that yet could easily start padding the end of the pdf with a random number of spaces to stop verification efforts.

It would be kind of neat if that could be layered so that one could not only verify that their source-provided copy is legit, but also that the underlying paper itself has also not been modified.

It should be pretty easy to do, to be fair. There are many ways. The easiest would be to have a compressed file (or whatever) that is signed with the source you downloaded it from (and the digest published), and the PDF itself would be signed with the authors' private key. It is not the best way to do it, but it could work.

You can store revisions in a Merkle tree, too.

Torrent file is a checksum.

Yes, the price we pay for the exploitation of stupid movies? Torrents should be the standard way to distribute anything.

Checksums are for error correction, I think you’re referring to digital signing, unless I’m misunderstanding the issue being referred to

In the context of sharing data between people, people use checksums with the same meaning as cryptographic hashes, as anything else would break for nearly all use-cases.

Digital signatures are actually overkill. The same infrastructure one uses to discover the authorship of a paper can distribute file hashes without any loss of autentiction, and I don't think anybody needs the non-refutation feature they bring. Maybe there is a nice use case for a paper authorship database with a PKI, but to my view the idea goes against an open scientific community that I think is much more valuable. (But again, maybe there is a way to have both.)

> I am afraid the basic problems are still not solved with regards to proof of authorship and file integrity

These are not basic problems. We're talking about scientific papers, not deeds to a piece of land or something.

> how do I know the pdf I’m downloading is what was published?

How do you know the paper photo-copy you have of an article is what was published? You don't 100% know, you make a reasonable assumption.

The exceptional case of needing integrity verification can have a niche solution.