# Signing Files vs. Signing File Hashes

What are the security pitfalls that may occur by signing a list of file hashes, versus signing individual files?

In short, the security trade-offs between:

for file in $FILES; do gpg --clearsign$file
done


And:

sha256sum \$FILES > signatures
gpg --clearsign signatures

• It should be noted that sha256sum doesn't just display the (hexadecimal) hash but also the file name, for those cryptographers with less *nix knowledge. – Maarten Bodewes Mar 3 '15 at 1:19

There are a few pitfalls:

File name integrity: signing files one at a time signs the contents of the files. It (typically) does not protect the file names from tampering. This could be disastrous in some situations (e.g. an attacker could change blacklist.txt to whitelist.txt).

Set membership integrity: signing individual files does not prevent adding or removing files from the set of files that were transmitted. In some cases, this is important: if you're transmitting a set of log files, an attacker could selectively remove one that captured incriminating information. If an attacker has the opportunity to see multiple transmissions, they could add files from an old transmission to the new transmission (essentially a variant on replay attacks). The files would still have valid signatures individually, so the additions would not be detected. If you're transmitting a set of user accounts (one per file), an attacker could revert their account to an earlier state (e.g. back to having admin status).

I recommend protecting the transmission as a whole instead of part-by-part, if possible. The easiest way of doing this is usually to create a tarball or zip file and sign the entire archive. Signing a list of file hashes is also adequate, but take care when coding the verification mechanism.

Signing files individually will create independent signatures for the contents (not filename) of each file. A potential downfall here is that the items could be removed or renamed without detection.

Let's say, for example, the files to be signed are alice-invoice, bob-invoice, and chris-invoice. If each file is individually signed, and bob-invoice is deleted, there is no way to detect the deletion.

Creating a list of files and hashes protects the integrity of the entire set of files because and allows the detection of file deletion or renaming. A potential downfall here is that proving the validity of a single file (to a third party) requires divulging the entire list of filenames and hashes.

In this case, if we need to prove that alice-invoice hasn't been modified, we must reveal the entire list (to prove the signature is valid), which reveals that we have invoices for Bob and Charles.

Another consideration: strictly speaking, the question only compares two uses of clear signatures. A clear signature includes a complete copy of the original file. That means that signatures of individual files must be protected with the same level of security as the original files. (This is another potential downfall of that method.) Detached signatures are smaller and do not reveal the contents of the signed file and may be worth considering.