Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm hashing using SHA 256 and signing a payload with a private key.The payload does not contain any password and would be HTTP(S) POSTed to server side. The payload contains some dynamic and constant app data such as current time stamp and a string constant. The idea is to trust this data once the signature validation is successful on the server side using the public key. What benefits or value does hashing provide in the current context?
Thanks
You cannot sign large data blocks using any of the commonly used asymmetric signature schemes.
For signing larger data, you would have to split it in blocks and sign, but if you just do that without nonces/padding/etc, it is very insecure.
If you use some high-level library for your signatures, it most likely already hashes the data you give it to sign so you don't have to do that yourself.
You can take a look at this answer which concerns the maximum size you can encrypt with RSA, but in RSA encryption and signing is practically the same operation. Here are some more details.
So if you have a 4096bit key (you should have at least that size) you can sign up to 501 byte. Since you want to sign more than that in most cases, you have to hash the data and sign the hash.
Another point is, that most asymmetric crypto operations are very slow compared to hashing or symmetric cryptography, so you don't want to sign thousands of blocks and then verify them.
