# Hash-Then-Encrypt or Encrypt-the-Hash?

My question is would it make any difference if I use SHA3 and hash a block of data and then encrypt it using RSA is most secure to do the reverse?

The question is about Site-To-Site transmission where the recipient needs to decrypt the incoming data.

What method is more secure and make it harder to decrypt: Hash-Then-Encrypt or Encrypt-the-Hash?

• – MCCCS Sep 8 '18 at 9:23
• Once you have hashed the data even you can't recover it without knowing the plaintext. What are you trying to achieve with the hashing part? Authenticity? Integrity? – Yolanda Ruiz Sep 8 '18 at 9:44
• @R1w, if the receiver needs to decrypt it, use authenticated encryption. If the receiver does not need to decrypt, then a plain hash or a MAC or a signature solves the problem, depending on what needs to be verified. – otus Sep 8 '18 at 12:09
• @R1w, you cannot decrypt hashed data. The solution for that problem is authenticated encryption, e.g. AES-GCM or ChaCha-Poly1305. – otus Sep 8 '18 at 12:20

Hash-Then-Encrypt or Encrypt-the-Hash?

Traditionally this means in (a)symmetric encryption one of the following:

$$C=E_K(M\parallel H(M))$$ $$C'=E_K(M)\parallel H(C')$$ $$C''=E_K(M)\parallel H(M)$$

The first scheme is subtly insecure, as can be seen in this answer.
The second scheme blatently provides no extra authentication because an attacker can just go ahead and change the ciphertext and because the hash function is public, re-compute the hash value.
The third scheme is also insecure because it leaks information about $M$, in particular if you have a guess for what $M$ could be, you just compute $H(M)$ and check if it matches with the provided value.

$$C=E_K(H(M))$$ $$C'=H(E_K(M))$$
but note that neither scheme is actually functionally correct as an encryption scheme because given $H(M)$ it is in general hard and a lot of guesswork to recover $M$ and so the intended recipient can't actually decrypt the message, even with the key.
As otus rightfully noticed in the comments what you want in this case is actually authenticated encryption where you, the sender, encrypt some piece of data, e.g. using AES-GCM and then the recipient uses knowledge of the same key you used to decrypt the data. You may also want to note that chances are you actually don't want to deal with AES-GCM itself yourself, but you probably want to have "simply" a secure transmission channel between your sites, which is exactly what Transport Layer Security (TLS) is designed to do. If you have a shared key at the two sites, you can easily use one of the PSK cipher suites for TLS and if not and you only have (authentic) public keys of the other site, you can use the more standard signature-based key exchanges.