Does it make any sense to hash parts of a hashing target?

Question

TL;DR;

Assuming I'm calculating SHA256 for an ECDSA, does it make sense to do SHA256(item1 + SHA256(item1') + item2 + SHA256(item2') + itemN + SHA256(itemN')) or it's the same (security-wise) as SHA256(item1 + item1' + item2 + item2' + itemN + itemN')? (hereunder + refers to as binary concatenation of operands' content in binary format)

Details

I have a data structure similar to the one below (presenting in JSON format for readability)

{
  "Lorem": 123,
  "Ipsum": "qwerty",
  "Items": [
    {
      "Id": 4321,
      "Data": "SOME_DATA_HERE",
      "ItemSig": "A_RELATIVELY_BIG_BINARY_STRUCTURE_AND_ECDSA_SIGNATURE_OF_HELLO_FIELD_CONTENT"
    },
    {
      "Id": 8765,
      "Data": "SOME_DATA_HERE",
      "ItemSig": "A_RELATIVELY_BIG_BINARY_STRUCTURE_AND_ECDSA_SIGNATURE_OF_HELLO_FIELD_CONTENT"
    }
  ],
  "Sig": "A_PLACE_FOR_ECDSA_SIGNATURE"
}

I also have an ECC key pair. Now, I need to sign over each element within the "items" array and then over the entire structure itself.

When signing over the entire structure, I'm proving some data in that structure (contents of Lorem and Ipsum), and per each Item, I'm proving that the item was in that structure (by including Id in the signature) and proving that item's content (by including ItemSig which includes the content).

I think it worth noting that I include ItemSig instead of the item's content in the structure's signature to prove that the item was signed by the same ECC key as the structure itself. This is because there are multiple ECC keys that are valid for signing, but it's considered invalid to sign items with one ECC key while signing the structure with another.

So the question is, what's better option for structure's Sig field (and why?), ECDSA(SHA256(Content)) where

1. Content = Lorem + Ipsum + Items[0].Id + SHA256(Items[0].ItemSig) + Items[1].Id + SHA256(Items[1].ItemSig) + Items[n].Id + SHA256(Items[n].ItemSig), OR
2. Content = Lorem + Ipsum + Items[0].Id + Items[0].ItemSig + Items[1].Id + Items[1].ItemSig + Items[n].Id + Items[n].ItemSig.

Answer 1

From the practical point of view both approaches have similar resistance to brute-forcing. From the implementation point of view it may be simpler to apply hash only once, without hashing of every single part.

Nevertheless I would suggest you to review your design and consider other options. Suppose somebody has received your message and validation shows, that Items[0].ItemSig and Items[0].Data to not match. This can have two reasons:

1. Either Items[0].ItemSig was invalid before you signed it (then the signer has faked the signature).
2. Or the signature was correct, but you have replaced Items[0].Data before signing.
3. Or Items[0].Data was modified on the way from you to the receiver.

Thus it will be hard to find out where the problem has happened.

That's why I'd suggest other approach. Think of separation of concerns. Don't consider the structure of what are you signing. Sign the whole element Items. Then if somebody receives your message and something is not consistsnet, it will be easy to check: One should just check if your signature matches the Items element. If matches, means there was no modification on the way from you to the receiver, and the problem occurred on the signer of Items[0].Data before you signed.

TLDR: I'd suggest to hash the whole element Items, not the parts of it, and without hashing of every single part of it.