Public-Key Cryptography Last reviewed: October 2026 • 8 min read

How Digital Signatures Use Hashes: ECDSA, Ed25519 & RSA

Public-key cryptography never signs raw messages directly; it signs a cryptographic hash of the message. Hashing condenses messages of any arbitrary size into a fixed-width mathematical digest and destroys algebraic malleability, preventing attackers from mathematically forging signatures without the private key.

💡

In short

Digital signature algorithms operate over finite mathematical curves where raw gigabyte files cannot fit. Hashing reduces the file to a compact 32-byte digest that can be signed in microseconds. Crucially, the one-way nature of the hash eliminates algebraic homomorphism, stopping attackers from multiplying two existing signatures together to counterfeit a valid signature for a third message.

01. The Plain-Language Analogy: The Wax Capsule Notary

Imagine signing a complex commercial real estate agreement consisting of 800 printed pages. You do not physically sign your signature across all 800 pages one line at a time.

Instead, the legal clerk compresses the entire stack of 800 pages through an unforgeable mechanical stamping dye into a single 1-inch titanium coin (the cryptographic hash). You press your official wax signet ring into hot wax directly onto the top of that 1-inch coin.

If someone later tries to alter a single comma on page 412, the entire document yields a completely different titanium coin, and your wax seal fails to match. You only signed a 1-inch coin, but because of the coin's mathematical fidelity, your signature legally and tamper-evidently binds every single paragraph in the 800 pages.

02. Step-by-Step Mechanics: The Hash-and-Sign Paradigm

Step 1

Serialize and Hash the Payload

The message M (whether a financial transaction, software binary, or email) is hashed using SHA-256 or SHA-512 to produce a 32-byte digest z = H(M).

Step 2

Generate Ephemeral Nonce k

In ECDSA, the signer chooses an ephemeral secret scalar k (deterministically derived via RFC 6979 to prevent catastrophic nonce reuse). In Ed25519, the nonce is derived deterministically from the private key and message hash.

Step 3

Compute Signature Pair (r, s)

The signer computes curve point R = k × G and takes the x-coordinate r. Then calculates scalar s = k⁻¹(z + r × privateKey) mod n. The resulting signature is the compact tuple (r, s).

Step 4

Independent Recipient Verification

The verifier hashes the received message to obtain z = H(M), computes u₁ = z · s⁻¹ mod n and u₂ = r · s⁻¹ mod n, and calculates curve point P = u₁G + u₂PublicKey. If the x-coordinate of P equals r, the signature is mathematically authentic.

Node.js ECDSA Sign and Verify:

import crypto from 'node:crypto';

// 1. Generate an ECDSA P-256 keypair
const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', {
  namedCurve: 'prime256v1'
});

const message = "Authorize transfer of 1.5 BTC to 1Q2TWHE3GMdB6BZKafqwxXtWAWgFt5Jvm3";

// 2. Hash and Sign (ECDSA over SHA-256)
const signer = crypto.createSign('SHA256');
signer.update(message);
signer.end();
const signatureHex = signer.sign(privateKey, 'hex');

// 3. Independent Verification
const verifier = crypto.createVerify('SHA256');
verifier.update(message);
verifier.end();
const isValid = verifier.verify(publicKey, signatureHex, 'hex');

console.log('Signature (ASN.1 DER hex):', signatureHex);
console.log('Cryptographic Verification Result:', isValid); // true

03. Worked Example: Bitcoin ECDSA Signature (Live Chain)

This is the authentic ECDSA signature from Satoshi Nakamoto's historic first peer-to-peer transaction to Hal Finney in Block #170 (TXID: f4184fc5...):

Transaction ID (TXID) f4184fc596403b9d638783cf57adfe4c75c605f6356fbc91338530e9831e9e16

Signature Algorithm ECDSA on secp256k1 curve with Double SHA-256 (SIGHASH_ALL)

Signature r Component 875db0b12ad7fce95a43905cfca7df51ba6bdad9ba4caea4407817454f4ee0b9

Signature s Component 78ec9071b6d19455e71465bc579b207559eac4cb0b29ff6d46059d64380eb971

DER Encoded Signature Size 71 bytes (Includes SIGHASH_ALL byte 0x01)

The transaction scriptPubKey and transaction inputs are hashed with double SHA-256. The resulting 32-byte digest is what Satoshi's private key signed, producing this 71-byte proof.

04. Common Misconceptions Corrected

✕ Misconception: "Digital signatures encrypt messages to keep them confidential."

Reality: Digital signatures provide authenticity, tamper detection, and non-repudiation; they do not provide confidentiality. The signed message is transmitted in plain text alongside the signature. Anyone with the public key can verify who signed it and verify that not a single byte was altered.

✕ Misconception: "Signing a hash is just a performance shortcut; signing raw data is purer."

Reality: Signing raw data in asymmetric algorithms is a catastrophic security vulnerability. In textbook RSA, signatures are multiplicative: Sign(m₁) × Sign(m₂) = Sign(m₁ × m₂). An attacker can combine two existing signatures to forge a valid signature for a third message without ever knowing the private key. Hashing destroys this multiplicative algebraic structure.

✕ Misconception: "A signature remains valid if someone edits minor formatting in the document."

Reality: Because the signature signs the cryptographic hash, changing even a single byte or invisible whitespace character triggers the avalanche effect, flipping roughly 50% of the hash bits. The signature verification will fail immediately.