= Transcript hash
{title2=$H(M_1\Vert\cdots\Vert M_n)$}
A \b[transcript hash] is a <cryptographic hash function> applied to the defined encoding of a <cryptographic transcript>. The included messages, ordering, boundaries and algorithm are part of its definition:
$$
T=H(M_1\Vert M_2\Vert\cdots\Vert M_n).
$$
In TLS1.3 the inputs include handshake type and length headers but exclude record-layer headers. A retry has an explicit synthetic-message substitution; ordinary payload concatenation is not that protocol's definition.<The Transport Layer Security Protocol Version 1.3 (RFC 8446)>[§4.4.1, Transcript-Hash, included headers and HelloRetryRequest substitution]{ref}
An original ten-byte example uses a deliberately separate toy format: one type byte, a two-byte big-endian payload length, then payload. The first message is `01 00 02 48 69`, carrying ASCII `Hi`; the second is `02 00 02 4f 4b`, carrying `OK`. The <SHA-256> digest of these ten bytes in that order is
`2cd107ca2c002f392a6c26a4b2ed3caca0c23ecf0d67e3a790e787800caadc19`.
Reversing the two encoded messages gives
`7efaeb2cd69eae34b41ea8316a104ba7964254bd86e9b9ba14df77bb29163b66`.
These are original computations, not TLS test vectors. Both message order and the encoded headers contribute to the input bytes.
<Incremental hashing of a cryptographic transcript> feeds those byte sequences into one continuing hash context and finalizes at the required point. It computes the same digest as hashing their full <concatenation>. Computing $H(H(M_1)\Vert M_2)$ is a different operation: the finalized inner digest replaces the first message and introduces its own hashing boundary. A running internal state is not interchangeable with a completed digest.
An unkeyed transcript hash alone does not authenticate who spoke. A <digital signature> or <message authentication code> binds it to the required authenticated context. Nor can a hash recover message boundaries omitted by an ambiguous encoder. TLS's Finished message illustrates the separate authentication step by applying <HMAC> to the specified transcript hash.<The Transport Layer Security Protocol Version 1.3 (RFC 8446)>[§4.4.4, verify_data computation]{ref}
Back to article page
