If a digital signature on a file is verified, is verifying the hash redundant?

Question

We have a script that digitally signs a file with a user's private key. The file and signature are then sent to an external server, where the signature is verified with the user's public key.

A sysadmin on our team wants the script to calculate the SHA-512 hash before sending, then have the hash verified on receipt. He says this is necessary to ensure the file isn't modified in transit.

I've replied that digital signing does just that: It calculates the hash of the file, the hash is encrypted with the private key. On receipt the hash is decrypted with the public key. The decrypted hash is compared to a newly calculated hash. If they match, that verifies both that the user's signature is legitimate, and that the file hasn't changed in transit.

I'd like to run this discussion past the Stack Overflow community: If a file is digitally signed and verified, is it necessary to separately calculate the hash before and after signing?

Answer 1

You are correct, signing a file means actually signing the hash of a file. Therefore to verify the signature, it is again necessary to calculate the hash of the file (which is done in place, while verifying). So no need to extra verify the hash.

There is a nice post on the security stackexchange: https://security.stackexchange.com/questions/198423/what-does-signing-a-file-really-mean/198428#198428

Bob uses her public key to verify it [the file] and gets her calculated hash. He then calculates the hash of the file himself (without the signature of course) and checks both hashes. If they match its the same exact version of the file Alice sent. If they don't match Mallory could have changed it.