title: What is the role of SHA hash in signing a document in OpenSSL library?
body: <p>I am following <a href="http://ruby-doc.org/stdlib-2.0/libdoc/openssl/rdoc/OpenSSL.html#module-OpenSSL-label-Signatures" rel="nofollow">OpenSSL</a> directives to generate signatures. I am using ruby 2.1.0 and am generating signatures like this:</p>
  
  <pre><code>document = "This is a simple string document to be signed"
  key = OpenSSL::PKey::RSA.new([private_key])
  digest = OpenSSL::Digest::SHA256.new
  signature = key.sign digest, document
  </code></pre>
  
  <p>The signature is transmitted and reaches the destination where it is to be verified. To verify, I do like this:</p>
  
  <pre><code>key = OpenSSL::PKey::RSA.new([pubkey])
  digest = OpenSSL::Digest::SHA256.new
  key.verify digest, signature, document # =&gt; valid
  </code></pre>
  
  <p>This is working because if we change just one letter of the document or signature, this returns invalid result:</p>
  
  <pre><code>key.verify digest, signature, changed_document # =&gt; Invalid
  </code></pre>
  
  <p>But with a different SHA, the verification command still results in a valid result:</p>
  
  <pre><code>digest = OpenSSL::Digest::SHA256.new('this will generate different SHA')
  key.verify digest, signature, document # =&gt; valid
  </code></pre>
  
  <p>It confused me. Shouldn't a different SHA hash result in invalid result? What is the role of digest here?</p>