Hashing, encryption and digital signatures: the difference

Three questions about the same file

A file may arrive unchanged yet come from an unknown source. It may be signed by someone known yet contain an error. It may be confidentially encrypted yet become unusable when a key is lost.

That is why I start with the task. Should a change be detectable? Should someone be unable to read the contents? Or should we be able to check which key was used to sign these exact data? A single word like “protected” does not answer those questions.

Hashing: the reference is part of the check

A cryptographic hash produces a fixed-length value. To compare a file, calculate it again for the received version. The meaning of a match also depends on how the expected value was obtained. A checksum next to an unfamiliar file does not make its source trustworthy. NIST: Secure Hash Standard

For an internal handover, I would record the date, file version and origin of the reference value together. This need not be elaborate: a confirmation already received through a trusted channel carries different weight from an anonymous download. How the hash itself is produced is explained in the SHA-256 guide.

Encryption: keys are part of the design

Encryption aims to make content unreadable without the right key. AES is a standardised symmetric block cipher. In AES-256, the number is the key length; in SHA-256, it is the hash length. Similar names do not make these methods interchangeable. NIST: Advanced Encryption Standard

In operation, an algorithm name is not enough. The format or protocol, mode of operation, key generation and storage, and handling of changes all matter. Authenticated encryption combines confidentiality with an integrity check. Proven libraries and suitable methods are helpful; selection and key management are covered by the OWASP guidance on cryptographic storage.

For a backup, I would also ask whether the key remains available if the original device fails, whether there is a separate recovery route, and whether anyone has actually restored the backup. An encrypted archive is initially just a file. Its usefulness in an emergency is demonstrated through restoration.

Digital signatures: a key is not yet a person

A digital signature is created with a private key and checked with the corresponding public key. It can reveal changes to signed data and verify association with the key used. Associating it with a person or organisation additionally requires trust in the link between identity and public key. NIST: Digital Signature Standard

A newly downloaded public key does not become trustworthy merely because it is beside the signed document. A compromised private key can also produce signatures that verify successfully. Key origin, validity and possible revocation are therefore part of the process.

A signature does not confirm independent review of the content either. Signing an incorrect number still publishes an incorrect number. This article distinguishes the technical methods; it does not address the legal effect of a particular signature type.

Example: a report from an AI workflow

The following is a proposed design, not a measured product result. An agent creates a report, and a person decides whether to use it. A hash identifies the exact version under review. Confidential documents are held in suitable protected storage. An approval refers to the exact version and the authorised person.

Now the checks can be distinguished: hashing concerns the file; access protection concerns its readers; approval concerns a decision; substantive review concerns claims and sources. None of these layers automatically replaces another.

This distinction matters to me in developing Alpine-X and Orivane. Their project pages describe their development status. This example does not promise that all these steps are implemented.

A useful statement for handover

Instead of simply calling a file “secure”, I would record exactly which data were checked, who may read them, what an approval refers to and how the correct version can be restored. That turns a technical property into a statement others can work with.