Do hash functions for digital signatures need to be preimage resistant? I understand that hash functions used for hashing a document or some data before signing it, needs to be collision resistant and 2nd pre-image resistance. Otherwise an adversary could &quot;look&quot; for two random documents with the same hash or for a second document, having the same hash as a given document, and just replace the &quot;original document&quot; with the &quot;fake document&quot;, because then the signatures of the two documents are also the same.
However, I see no reason, why a hash function for signing documents needs to be preimage resistant, or is it indeed a superfluous property?
A hash function which isn't preimage resistent is also not collision resistance.
If I hash a large random message and apply the preimage algorithm I'm extremely unlikely to get the same message I started with, thus finding a collision.
Collision resistance is critical for a hash used in a signature. As you can create forged signatures. Even though you need a bit more in order to forge meaningful messages, such as exploiting internal state collision to make extensions collide and utilize formats like pdf or postscript.