PKI Encrypted hash vs Signing I have a confusion in a concept under cryptography context. What is the major difference between an encrypted hash and digital signed hash?

I have used PKI Encryption i.e. public / private key based encryption.

I calculated the hash and encrypted it with the private key of sender. Now, the receiver can unlock the hash with the public key of sender. Hence it proves the authenticity of the data. Now receiver can regenerate the hash and match with the decrypted one and if matches then it proves the data integrity.

Similarly, the signature is created by an hash and same is encrypted; and it is done by private key of sender. Now the receiver can verify the signature by public key of sender. It proves both authenticity and integrity.

I have used both in my case (that i am developing). I think I am using signature / hash as an extra element and only one of them will suffice.

Or is their any benefit of using both or any difference?
The difference between encrypted hash and a digital signed one is twofold:


the key to be used for signature generation is the private key, so technically it is not encryption;
the padding scheme is different for both situations.


The use of the wrong key is already enough to not talk about encryption as explained in my Q/A here.

In the case of PKCS#1 v1.5, both encryption and signature generation are often referred to by the same name. However, both use a rather different scheme for the padding of the content (the plaintext message for encryption and the hash for signature generation).  For RSA v1.5, RSA encryption is called RSAES-PKCS-v1_5 and uses the EME-PKCS1-v1_5 encoding scheme. Signature generation is called RSASSA-PKCS-v1_5 and it uses the EMSA-PKCS1-v1_5 encoding method. Note that these names have only been introduced in version 2.0 from the specification.

The main issue is that the padding for encryption was designed to add a random component to the padding. This is required because otherwise identical messages would result in identical ciphertext, leaking information to anybody seeing both ciphertext. As it is random padding, it cannot be validated. On the other hand, signature generation uses a known padding which can be validated. This is important because you would want the unpadding to fail when verifying the signature in case it has been tampered with.

So using the wrong padding scheme means that the security premises of the RSA mode and padding are not valid anymore. This is one more reason why signature generation should not be thought of as encryption of a hash value. Both use the RSA problem to be secure. Practically speaking only the modular exponentiation is identical for both.