# Is it secure to repeatedly rehash a digest to extend the digest length?

Upon reading through the source code of Rainbow, a post-quantum signature algorithm, I found a hashing function that, using SHA-512, produced a variable length digest.

This was achieved was by initially hashing the message to obtain a 64 byte digest, and then hashing that digest, and again, each time hashing the N - 1 digest. It's essentially being used as a deterministic CSPRNG.

Is this secure? Can SHA-512's digest be stretched out indefinitely like this? And why didn't Rainbow simply use a well-studied CSPRNG like ChaCha20?

1: OFB-Mode is a way to construct a PRG and an CPA-secure encryption scheme out of a fixed-length PRF. It works essentially as $$K_i=F_k(K_{i-1})$$ outputting $$K_1\|K_2\|\ldots\|K_\ell$$ for a PRF $$F$$ and a secret random key $$k$$.
• OFB mode and PRGs, in which $f$ is a private random function, are a lot different than hashing, where $f$ is a public random function. If $f$ is a public random oracle, and $K_i = f(K_{i-1})$ then I can easily distinguish $K_1\|K_2\|\cdots\|K_n$ from random. – Mikero Nov 2 '20 at 21:48