How to prove that two hashes correspond to the same original message, without using the message to verify?

Let's suppose this:

• Message is "I love crypto.stackexchange.com" (M)
• Bob creates hash H1 with the message M and his private key (Priv)
• Alice receives a message X, and hash H2 with message X and the public key of Bob (Pub)

So from 1=(,Priv) and 2=(,Pub) can we tell if =? (thanks to @fgrieu)

If it's not possible with a standard hashing function for an asymmetric cryptosystem, in what case it would be possible?

The goal here is to verify the integrity of a message and of the author through the use of two hashes (which serve as proxies of messages and identity of the author).

Thanks!

I'll rephrase the question as:

• Bob draws a public/private key pair $(\text{Pub},\text{Priv})$, and publishes $\text{Pub}$
• Bob somewhat obtains $M$, then computes and publishes $H_1=H(M,\text{Priv})$
• Alice somewhat obtains $X$, then computes and publishes $H_2=H(X,\text{Pub})$
• A referee Robert, assumed to have unaltered $H_1$, $H_2$, and $\text{Pub}$, wants to determine if $M=X$.

That can't be achieved with a regular cryptographic hash for $H$ (that is, a hash that aims at behaving as a random oracle), because whatever relation between $\text{Pub}$ and $\text{Priv}$ making them a public/private key pair is immaterial to the hash, making the equality of $M$ and $X$ indiscernible from $H_1$ and $H_2$. As far as I can tell, that's including for hash-based signature like Lamport and friends even if the hash is the one used in the signature system.

But we can craft a special construction for $H$ that allows what's asked:

• $(\text{Pub},\text{Priv})$ are assumed to be for a signature system such that it's possible to distinguish a public key from a private key. This could be EdDSA.
• We assume a standard hash function $H'$ with the same output width as a signature.
• Given input $(I,K)$ and asked to compute $H(I,K)$, our $H$ recognizes if $K$ is a private key
  • if so, then $H$ computes and outputs $H'(I)\oplus\operatorname{Sign}_{\text{Priv}}(H'(I))$, so that $H_1$ is $H'(M)\oplus\operatorname{Sign}_{\text{Priv}}(H'(M))$.
  • otherwise, $H$ computes and outputs $H'(I)$, so that $H_2$ is $H'(X)$.
• Robert tests if $M=X$ from $(H_1,H_2)$ as $\operatorname{Verify}_{\text{Pub}}(H_2,H_1\oplus H_2)$, where the signature's verification function $\operatorname{Verify}_{\text{Pub}}(J,S)$ returns true or false according to if $S$ is a signature of $J$ under a private key matching $\text{Pub}$, or not.

Note: the $\oplus$ is here so that the output of $H$ is indistinguishable from random for one without a full guess of it's message input $I$ (here $M$ or $X$), as expected from a standard hash. That assumes some plausible hypothesis for the signature, such as this one almost universally met: the signature's message input is only used as part of the input of some hash.