Based on my knowledge, all digital signature algorithms use a hash function to sign a message, and then encrypt the hash result. So why do these algorithms not use a checksum instead of a hash algorithm? By the end, both are going to encrypted, correct? A checksum is faster than a hash algorithm.
$\begingroup$
$\endgroup$
2
-
9$\begingroup$ The underlying hash-function must not have any collisions. Otherwise, two documents $M$ and $M'$ with $H(M)=H(M')$ would have the same signature. $\endgroup$– VincBreakerApr 1, 2018 at 17:11
-
4$\begingroup$ "Based on my knowledge all digital signature algorithms use a hash function to sign a message, and then encrypt the hash result."; actually, only RSA and Rabin-Williams can really be described that way (and even in those cases, it's not precisely accurate). Other signature algorithms work differently; generating a hard to duplicate/easy to verify relation between the signature, message and public key $\endgroup$– ponchoApr 1, 2018 at 20:07
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
A digital signature can only sign a relatively small amount of information, which is why the digest is signed instead of the original message. Because of this limitation, the digest must be a faithful representation of the complete message. A cryptographically-secure hash is require to resist collision attacks, second preimage attacks, and preimage attacks, all of which can invalidate the guarantees that people expect from a digital signature. In other words, if one signature is valid for two distinct messages, the signature is useless. A cryptographically-secure hash prevents this.
Also note that digital signatures are not simply encrypted digests. This is a simplified explanation which is common, but technically incorrect. This answer describes signatures for RSA.
