How to know which hashing algorithm is being used?

Question

I’ve been reading about digital signatures getting ready for some certification, and there is one question regarding this topic, that I don’t really understand.

Let’s say that I receive a plaintext with digital signature. I use the public key of the sender to decrypt. Now I have a “pure” hash. In order to check if it’s coming from a legitimate person, I need to hash the plaintext on my own.

But how do I know, which hashing algorithm has been used? Do I check the number of bits of the hashed function or something else?

Answer 1

The hash file algorithm is (usually) sent together with the file, i.e.

Before sending a file, User1 uses a hashing algorithm to generate a checksum for a file. Then he/she sends it alongside the file itself. User2 receives both the file and the checksum. Now he/she can use the same hashing algorithm on the received file. What’s the point? We already know that a hash is individual (so there can’t be any other file with the same hash) and has to be always the same for an individual file. No matter how many times you use the hash algorithm, it will always give you the same result. So now, User2 can compare both hashes. If they’re the same, it means it’s generated from the same file. There is no way that any other file has the same hash and there is no chance for a hash to be different for the same file.

Taken from here: https://blog.jscrambler.com/hashing-algorithms

Hope that helps.

Answer 2

In most cases the hash algorithm is known beforehand or can be guessed from a short list. For example, RSA signatures usually use some version of the PKCS standard which either specifies the hash or encodes it using ASN.1 format.