= Incremental hashing of a cryptographic transcript
\b[Incremental hashing of a cryptographic transcript] supplies successive encoded message bytes to one continuing <cryptographic hash function> state. Finalizing after the selected messages gives the same <transcript hash> as hashing their full <concatenation> in one call. TLS explicitly permits implementing the handshake computation using a running hash.<The Transport Layer Security Protocol Version 1.3 (RFC 8446)>[§4.4.1, transcript encoding; §4.4.4, running handshake hash]{ref}
For an original <SHA-256> example, updating with ASCII `ab` and then `c` gives the same result as one update with `abc`:
`ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad`.
A chunk boundary is an input-delivery detail. It does not insert a separator byte or end a message. A continuing implementation must preserve the processed bit count and any incomplete block as well as its chaining state; final padding encodes the complete input length. SHA-256's specification processes 512-bit blocks and pads the complete message before its final compression operations.<Secure Hash Standard by National Institute of Standards and Technology>[§§5.1.1–5.2.1, padding and parsing; §6.2.2, block iteration]{ref}
In particular, $H(\mathtt{ab}\Vert\mathtt c)$ and $H(H(\mathtt{ab})\Vert\mathtt c)$ specify different inputs. The latter inserts a completed digest, with its already finalized hashing boundary, where the original bytes belonged. It is not an incremental implementation of the former.
The protocol must still define which bytes enter the state. TLS includes handshake headers in the <transcript hash> and specifies a special first-message substitution after a retry. A running hash implements that prescribed input, rather than defining the transcript by itself.<The Transport Layer Security Protocol Version 1.3 (RFC 8446)>[§4.4.1, headers and HelloRetryRequest]{ref} An unkeyed digest also supplies no sender authentication by itself; the protocol must bind it through its specified <digital signature> or <message authentication code>.
Back to article page
