Upon reading through the source code of Rainbow, a post-quantum signature algorithm, I found a hashing function that, using SHA-512, produced a variable length digest.
This was achieved was by initially hashing the message to obtain a 64 byte digest, and then hashing that digest, and again, each time hashing the N - 1
digest. It's essentially being used as a deterministic CSPRNG.
Is this secure? Can SHA-512's digest be stretched out indefinitely like this? And why didn't Rainbow simply use a well-studied CSPRNG like ChaCha20?