Signing and hashing are specific cryptographic operations with well defined properties. You can’t use them interchangeably if you want to be taken seriously.
The usual process of signing a bunch of data is to hash it and then encrypt it with public key encryption, so the hash function is as important as the public key encryption scheme.
If the hash is weak, an attacker may be able to construct compromised data that hashes to the same hash, and the whole signature becomes worthless.
Signing is basically hashing + proof of who created the hash. You need either both, or a way to find which hash is correct according to someone, usually the owner of the artifact, and signing gives you just that.
In this case, the hash is the message being encrypted. It's the (c), as I indicated in my previous post. The text being signed is not encrypted, but the signature still involves encryption.
it is about timestamping basically nothing else. basically that cannot sign something in the past. Though you can do the same with sequence number, and publicly publishing all signed hashes.
You could sign the data. Distribute the public key far and wide. Destroy the private key before you die. The advantage of this approach over just the hash is that you can sign an unlimited number of files and can verify them all with just one public key. It is all authenticated by your identity.
If your signature scheme is broken over the years then that means that people can tamper with the files. So you can use different schemes just as with the hashes.
Who is going to be able to verify your identity after 500 years and/or have a verified copy of the hashes? Without the concept of identity, it's all just a bunch of bits.
reply