the standard construction where you sign the fixed-size digest of a message rather than the message itself, so signature cost stays flat no matter how big the content is.
Three chunk sizes, one cid, one signature - why signing cost never sees content size.
Hand-authored SVG for this glossary, 2026. Domain string per sign.rs SIG_DOMAIN (lines 13-20).
Etymology and backstory
as old as practical digital signatures - RSA and DSA deployments have always hashed first, both for performance and because the security arguments model the hash as compressing the message into the signature scheme's domain. The subtlety that matters: the signature is only as strong as the hash's collision resistance, because two messages with one digest would share one signature.
Ecosystem
every TLS certificate, every signed git tag, every code-signing system is hash-then-sign. The design question is never whether to hash first but WHICH bytes get hashed and how the message is framed.
In codexproof
Ed25519 signs the domain-separated message "prov-sig:v1" plus a newline plus the cid - not the chunk bytes and not the JSON. That is why signing time is flat (~11us) regardless of how large the evidence chunk is, and why the signature and the integrity check compose cleanly: verify the cid against the bytes, then the signature against the cid. Two checks, one 32-byte meeting point.