Description of intermediate hashes
Intermediate (or partial) hashes are canonical forms of digest state that can be transferred from one hash implementation to another, so that the other, limited device (e.g. a smart card chip) can finish the hash calculation with the remaining data. This scheme is used to create a signature generation system consisting of the devices performing the calculations.
So:
- Terminal generates intermediate hash by processing the first i blocks of the message;
- Terminal sends intermediate hash to the smart card;
- Smart card finishes the hash with the last (N - i) blocks of data;
- Smart card creates the signature and sends it back to the terminal;
- Sends back the signature.
instead of:
- Terminal creates full hash;
- Terminal sends full hash to the smart card;
- Smart card creates the signature and sends it back to the terminal;
- Sends back the signature.
Obviously letting the smart card generate a full hash has drawbacks with regards to performance if the data to be hashed is large. This can still be an option, e.g. when the signature is generated over signed attributes instead of the content itself.
Intermediate hashes are not specified in the SHA-1, SHA-2 or SHA-3 standards.
Possible reason for using intermediate hashes
In my previous question I've already asked about if other protocols use partial hashes. Due to the limited amount of feedback there I'll probably have to conclude that they are not often used.
I've mused there that intermediate hashes could possibly be used to avoid covert channels, i.e. the insertion of data other than a hash into the signature generation. I'm not sure that this would pose a significant threat though (as the provider of the hash could also provide a hash over anything else).
Question
What cryptographic rationale is there to use intermediate/partial hashes instead of full hashes provided by the terminal?