If data (e.g. an e-mail, pdf file, xml content) is hashed using SHA-1 and then signed by a SHA-2 certificate, is this any bigger of a risk than using a SHA-2 hash with a SHA-2 certificate?
I assume in this scenario although the actual file content COULD be collided (as being hashed using SHA-1), in practice the risk is very small since the signature is made by a secure SHA-2 certificate.
In my question “SHA-1 – Why is it hard to find a certificate collision?” I stated colliding a certificate is harder than a PDF file. However, does this hold up for ANY kind of signed file? A certificate is basically a file with a signed hash. So what if I take a signed PDF? Or a signed e-mail? Would it still be hard to attack and why?