Pular para o conteúdo principal

What is the difference between the functions signData and signHash?

Both functions -- signData and signHash -- run a digital signature algorithm with the private key of one of the certificates on the user's computer. To understand the difference between the two functions, we need to talk briefly about the details of a signature algorithm.

note

The term digital signature algorithm should not be confused with digital signature. Read more about this subject in the article Digital signatures.

The RSA algorithm, broadly speaking, has 4 steps:

  1. Computing the hash of the bytes to be signed
  2. Encoding the DigestInfo structure, which contains the hash and the OID of the hash algorithm used to produce it
  3. Padding the encoded DigestInfo
  4. A mathematical operation on the encoded and padded DigestInfo
note

The hash computed in the first step is usually not the hash of the document being signed. In the CMS/CAdES, PAdES and XmlDSig/XAdES signature schemes, the bytes used as input to the signature algorithm are the encoding of the "signed attributes", a structure that contains various data, among them the document hash.

The signData function takes the to-sign-data as input and performs all the steps on it, while the signHash function takes the to-sign-hash, that is, the precomputed hash of the to-sign-data, and performs on it only the second step onwards.

Both functions can be used to implement web remote signatures regardless of the signature scheme (CAdES, PAdES, etc.) being used. Which function to use depends on the output of the backend code at the end of the remote signature "preparation". If it produces a to-sign-data, use the signData function. If it produces a to-sign-hash, use the signHash function.

View as Markdown