3

I understand that a cryptographic hash function is a function that generates a fixed size random string for an arbitrary input.

However, is it possible to use a cryptographic hash function for digital signature?

1
  • 1
    Don't have time for an answer, but the answer is currently "somewhat" and it's an active field of research: blog.cryptographyengineering.com/2018/04/07/… Feel free (anyone) to elaborate a little more and base an answer on this blog post.
    – Luc
    Oct 26 '18 at 7:51
5

Is it possible to use a cryptographic hash function for digital signature?

You can't use a hash function as a signature, but you -already- use a cryptographic hash function as part of procedure for a digital signature.

Let's first, mention some common reasons for applying a digital signature to communications:

  • Authentication
  • Integrity
  • Non-repudiation

Why we need Integrity?

If a message is digitally signed, any change in the message after signature invalidates the signature. Furthermore, there is no efficient way to modify a message and its signature to produce a new message with a valid signature, because this is still considered to be computationally infeasible by most cryptographic hash functions (see collision resistance).

What are these cryptographic hash functions?

A cryptographic hash function is an algorithm that takes an arbitrary amount of data input—a credential—and produces a fixed-size output of enciphered text called a hash value, or just “hash.” That enciphered text can then be stored instead of the password itself, and later used to verify the user. source

What's the procedure to sign a message?

enter image description here source

2

I understand that a cryptographic hash function is a function that generates a fixed size random string for an arbitrary input.

No; Hash functions don't generate a random string. They are deterministic one-way functions. The output may look like random, but they are not.

Every hash function has collisions that two different messages1andm2can have same hash valueh(m1) = h(m2)andm1 != m2`. We can see this by pigeon principle.

However, is it possible to use a cryptographic hash function for digital signature?

No;

Your sign is unique to you when you sign a paper document, check,etc., later signature experts can decide that this is your signature or not.

Similarly, a digital signature is unique to you. You digitally sign a document with your private key so that others can verify your digital signature by using your public key.

Let, you hashed a file and distributed as a signed document by you. You want to claim that you are the signer. You put the file into the known hash function and generate the hash. Anybody, also, can use this document and calculate the hash to claim the ownership or claim the ownership. There is no authentication.

Let, I hashed a document and claimed that you signed (hashed) this document. Can you show me that you are not the signer? You cannot repudiate.

-1

From my point of view, a cryptographic hash function is a function that given an input of bytes generates a hash signature data. These functions are in general the well known sha1, sha256, blake2s, and so on. This hashes in general verify the integrity of data, for example

>>> hashlib.sha256("Good morning").hexdigest()
'90a90a48e23dcc51ad4a821a301e3440ffeb5e986bd69d7bf347a2ba2da23bd3'

so if you change one byte on the source the generated hash will change completely

>>> hashlib.sha256("G0od morning").hexdigest()
'0057a9d2c5921a6a092d172167fa2874dcdf5d3d866667eba5502b7fa20c6fd3'

This can be used for many things, such as data integrity, generation of digital signatures and many others.

So when you generate a "digital signature" probably is a combination of hash + encrypt some data and public & private key techniques.

Hope it helps you but the question is not clear at all

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.