Using hash for data integrity and authenticity, how?

Question

If you want to preserve the integrity and authenticity of data in a system using blockchain, what is a better solution:

-to store hash(data+signature[data])

or

-to store both hash(data) and hash(signature[data]) separately

What is used in practice?

Answer 1

Taking a hash of the concatenation of hashes is perfectly fine. It's how Merkle trees work. Blockchains are Merkle trees, by the way.

You can also hash the concatenation of multiple pieces of data, some of which may be hashes. You have to be careful that the concatenation is unambiguous, however. It is not true in general that if H(A1+B1) = H(A2+B2) then A1=A2 and B1=B2: the implication is true only if you know, for example, that A1 and A2 have the same length. Otherwise the end of A could move to the start of B: if A1=P+M then H(A1+S) = H(P+B2) where B2=M+S, since A1+S = P+B2.

A convenient way to avoid such ambiguities is to hash every piece of the data, then hash the concatenation of the hashes. So rather than H(data+signature[data]) (potentially ambiguous if there can be different-size signatures) or H(data)+H(signature[data]) (needlessly long), store H(H(data)+H(signature[data])).