title: Why should I sign a "hashed HMAC" with my private key? what the case?
body: <p>I'm new in cryptography and I attended a session that talks about the digital signature, and the speaker said that in some cases we need to generate the &quot;HMAC Hash&quot; then sign it with my private key.</p>
  <p>Question: isn't it enough to sign the hash of the message without using &quot;HMAC&quot; (just the hash)  with my private key?</p>
  <p>I think it is enough to validate that no one but me can generate this message, so it should verify the data integrity also as the hash is covered with my private key encryption &quot;signature&quot; and finally, it should save non-repudiation as well.</p>
  <p>So, is there any case that can cause a vulnerability if we use the hashing algorithm without HMAC in order to keep authenticity, data integrity and non-repudiation?</p>