I understand that signing is often a case of hashing data and
then encrypting the hash with the private key. What properties
keep Diffie-Hellman from being useful for this? Actually the
presentation of digital signatures as "encryption with the
private key" is a misleading historical way of explaining RSA
signatures; but it really works only for RSA. For such a scheme
to work, you need the asymmetric encryption algorithm to be a
trapdoor permutation, so that the space of encrypted messages is
the same than the space of decrypted messages. Most asymmetric
encryption algorithms are not trapdoor permutations. This does
not mean, however, that it is not possible to reuse parts of an
asymmetric encryption algorithm to design a digital signature
scheme. Consider Diffie-Hellman. It is not an asymmetric
encryption scheme; only a key exchange algorithm (a key exchange
algorithm can be viewed as an asymmetric encryption algorithm in
which you do not get to choose what is the encrypted message you
send). From DH, we can