Is it secure to repeatedly rehash a digest to extend the digest length?

Question

Upon reading through the source code of Rainbow, a post-quantum signature algorithm, I found a hashing function that, using SHA-512, produced a variable length digest.

This was achieved was by initially hashing the message to obtain a 64 byte digest, and then hashing that digest, and again, each time hashing the N - 1 digest. It's essentially being used as a deterministic CSPRNG.

Is this secure? Can SHA-512's digest be stretched out indefinitely like this? And why didn't Rainbow simply use a well-studied CSPRNG like ChaCha20?

Answer 1

Section 2.6 of their submission talks about this. There they state that for most cases they simply use SHA-256, -384 or -512. In the (uncommon?) case that a hash function with a larger output is needed, they use the OFB-like¹ construction. The rationale being that a collision on the OFB construction would immediately imply a collision on the underlying hash function - as the direct output is part of the expanded output. This also explains why they don't want to involve another (more efficient) function: To reduce security guarantees and prefer simplicity over optimization for rarely needed scenarios.

---

_{1: OFB-Mode is a way to construct a PRG and an CPA-secure encryption scheme out of a fixed-length PRF. It works essentially as $K_i=F_k(K_{i-1})$ outputting $K_1\|K_2\|\ldots\|K_\ell$ for a PRF $F$ and a secret random key $k$.}