Hashing and digital signatures in blockchain

A blockchain needs two different cryptographic checks. A hash tells you whether bytes changed, and a digital signature lets nodes verify that the holder of a private key authorized a specific message. I ran the OpenSSL verification below with a secp256k1 key, then changed the message to confirm that verification fails.

The short answer

Hashing and signing solve separate problems. A cryptographic hash produces a fixed-size digest from input bytes, while a signature lets anyone with the matching public key verify that the signer approved a message.

Blockchains use hashes for transaction identifiers, Merkle trees, and links to earlier block headers. They use signatures to authorize transactions before nodes apply the network’s validation and consensus rules.

What a cryptographic hash does

A cryptographic hash function maps an input of any practical length to a digest with a fixed length for that algorithm. NIST’s Secure Hash Standard describes message digests as a way to detect whether a message changed after its digest was generated.

A hash detects a changed payload

Hash functions are deterministic. Give SHA-256 the same bytes and it returns the same digest. Change even one byte and the digest changes, which gives you a compact integrity check.

A digest does not reveal who created the data or who approved it. It also does not reconstruct the original message, and it does not encrypt that message.

Where hashes appear in a blockchain

A block header can contain a digest of the preceding block header, so changing an earlier block changes the reference held by its successor. Bitcoin’s reference documentation also describes a Merkle root in the block header, which summarizes the block’s transaction identifiers.

This structure makes a changed history detectable. Whether a network accepts any replacement history depends on its consensus mechanism, validation rules, and the work or stake behind competing histories.

What a digital signature does

A digital signature is created with a private key and checked with its paired public key. A valid verification shows that the signature matches the supplied message and public key.

Signing and verification

Signing software hashes the message as part of the signature scheme, then produces signature data with the private key. Verification recomputes the required digest from the supplied message and checks the signature against the public key.

NIST FIPS 186-5 specifies approved digital-signature algorithms that use hash-function output, and Bitcoin’s developer documentation uses signature operations to verify transaction data against a public key.

A signature does not encrypt a transaction

Signing proves authorization and detects changes to the signed message. Encryption hides content from parties without a decryption key, which is a separate cryptographic job.

That distinction matters when you read protocol documentation. A public blockchain can expose transaction data while still requiring a valid signature before a node accepts a spend.

Run a small verification example

The following shell script hashes two transaction-like records, generates a secp256k1 key pair, signs one message, and verifies it. It then changes the amount and checks the original signature against the changed message.

cat > hash_records.py <<'PY'
import hashlib

records = [
    "from=alice;to=bob;amount=7",
    "from=alice;to=bob;amount=8",
]
for record in records:
    print(f"{record} -> {hashlib.sha256(record.encode()).hexdigest()}")
PY

python3 hash_records.py
printf 'transfer=alice-to-bob;amount=7\n' > transaction.txt
openssl ecparam -name secp256k1 -genkey -noout -out private.pem
openssl ec -in private.pem -pubout -out public.pem
openssl dgst -sha256 -sign private.pem -out transaction.sig transaction.txt
openssl dgst -sha256 -verify public.pem -signature transaction.sig transaction.txt
printf 'transfer=alice-to-bob;amount=8\n' > altered.txt
openssl dgst -sha256 -verify public.pem -signature transaction.sig altered.txt

Hash two transaction records

Only the amount differs between the records, yet each SHA-256 digest changes. A node or application can compare digests instead of comparing every byte in a long payload.

Sign and verify a message

The original transaction returns Verified OK. After the amount changes, OpenSSL returns Verification failure because the signature binds to the original message.

What hashes and signatures cannot prove

A valid signature proves control of the signing key for that message. Network validation still checks available funds, contract conditions, and protocol rules.

A matching hash proves that the compared bytes match the digest. The digest alone says nothing about whether the source data was correct, private, or accepted by the network.

How to inspect a blockchain design

Start by locating the exact bytes that a protocol hashes and the exact bytes that a wallet signs. Then identify the public key or address relationship used during verification.

Finish by reading the validation rules that run after signature verification. That sequence separates integrity, authorization, and network acceptance instead of treating them as one cryptographic claim.

FAQ

For any blockchain protocol, inspect the signed bytes, the verification key, and the rules that decide whether the network accepts the transaction. Those details tell you what the cryptography establishes.

Sources: NIST Secure Hash Standard, NIST Digital Signature Standard, and Bitcoin Developer Documentation on transactions.