# Is signing a hash instead of the full data considered secure?

I reference object in some of my code in hashes. The signature is itself is another object separate from the one I am signing (for obvious reason). I consider simpler to simply sign the reference to my object (it's hash), but I wonder if it is considered secure.

Here's a more complete explanation:

A: Is the data object to be hash then signed
H: Is hash(a), the reference to A
S: Is the signature object which contain H and sign(H)

S and A are sent on the network so A can be verified with its signature

Hash algorithm is SHA-256 and signature one is ECDSA.

-

Most signature schemes actually incorporate a one-way function (hash) in the algorithm. Partly this is necessary to be able to sign an arbitrarily large message at all, partly this is necessary to avoid some kinds of forgery attacks on the signature scheme (often it is easy to find a "signature" which is valid, but due to the one-way function it is not easy to find a fitting message).

And as long as your hash function is collision-resistant, an additional hash is not a problem. (This means: Don't use MD5 here. But with SHA-2 you should be safe.)

As a general idea, all used algorithms should have a security level of at least the level you want to achieve – for (non-broken) hash functions, this generally means $2n$ bit output for $n$-bit security, a similarly large elliptic curve (for EC-signature), and modular discrete log or RSA signature keys should be correspondingly even larger (see keylength.com for a comparison).

-
Of course I would never use MD5 for that purpose. –  Gopoi Feb 13 '13 at 17:01
OK answer, but I would add something about the security of the used algorithms. It's possible but not advisable to hash something using SHA-1 before encrypting it with a very secure key (e.g. one created for a 521 bit NIST curve). –  owlstead Feb 13 '13 at 22:36

This is secure, and a lot of systems actually do signatures this way (for example, PGP). One reason to do this for performance. Signing a hash is much faster than signing your whole message. It is also non-trivial to hash large messages since signature functions usually operate on a bounded size input.

An attacker will have just as much difficulty forging a signature on the hash as they would forging the signature on the message itself.

-
Perfect what I wanted to ear. –  Gopoi Feb 13 '13 at 5:23
Actually, most signature primitives (i.e. when used without a hash) can only sign a limited amount of data (in the order of the key size). It is not clear at all how signing a larger message would look like, so you can't say that the performance is the reason. –  Paŭlo Ebermann Feb 13 '13 at 20:58
@PaŭloEbermann I've added that to the answer. –  Oleksi Feb 13 '13 at 21:03

There is no meaningful distinction between these two things. Consider this scheme:

1. Hash the object.

2. Sign the hash.

Now, does this scheme sign the hash or the full object? Step 2 signs the hash. But the scheme signs the full object. So which is it?

-
I guess they both sign the data. Hey! you are on bitcoin too....Well Hi! –  Gopoi Feb 13 '13 at 5:25
I have met several case where there has been great confusion about that. For example, in a GlobalPlatfrom context, the signature of an applet may be the signature of the hash of the applet, where signature includes a further hashing step (thus, the hash gets re-hashed). Then there is the question of if we sign the hash, or the dreaded ASN.1 encoding of the hash; and which hashes these are; and if the indication of the hashing scheme within the signature is encoded in the signature, or implicit... –  fgrieu Feb 13 '13 at 14:43
The great thing about standards is that there are so many to choose from. –  David Schwartz Feb 13 '13 at 14:59