Document Hash: Meaning and Signing Uses

What is a document hash?

A document hash is a fixed-length digest computed from specified data using a hash algorithm. The same input and algorithm produce the same digest. An alteration to the input is expected to produce a different digest with a suitable cryptographic algorithm.

NIST’s Secure Hash Standard specifies algorithms including SHA-256. A digest is not an encrypted copy of the document and is not intended as a reversible way to recover its contents.

Hashing a file versus hashing signed data

Know which bytes were hashed. Two PDFs can look identical while having different underlying data, for example after conversion or metadata changes. A whole-file hash therefore answers a different question from a visual comparison.

A PDF digital signature covers designated byte ranges, excluding the signature-value placeholder. Permitted incremental updates can retain an earlier signed version while changing the whole file. PDF Association’s technical note on digital signatures explains this structure. A new whole-file digest is not, by itself, proof that an earlier signature is invalid.

What does a matching hash prove?

It supports comparison with the reference data, subject to the algorithm and process. The reference must be trustworthy. Someone who supplies an altered file and a newly computed hash has not established the authentic original. Collision resistance is a security property, not a promise that collisions are mathematically impossible.

Hashes alone do not identify the author, establish signing intent or grant authority. Their role in signature validation depends on the signature mechanism, keys and trusted certificate binding surrounding them.