Hashing vs. Signing Binaries

Question

If you want to ensure that a file is valid (untampered and came from the correct/expected source), there are two things you can do: hashing, and signing

Answer 1

The big difference between providing some data (an executable a document, whatever) along with a hash and providing the same data with a signature is with the hash, both the data and the hash value come from the same place. So, if someone can compromise one of them, he can probably also compromise the other.

For example, if I can hack into your web server, I can easily replace your executable with my own version and replace the hash value with the correct hash for my executable.

If you sign your executable, I can't just produce another signature for a different executable and replace your original signature. The signature verifies both the hash of the original data (the data has not changed since being signed) and that the signature was generated by your private key.

Of course, this all assumes that people who receive your signed executable have received your public key in some trusted way. If I can trick people into using my public key instead of yours, then I can hack into your website and replace your signed executable with my own. That's why we have certificate authorities.

This page has a high level overview of digital signatures.