Why hash random bytes?

[Dissimilis]

Why are you requiring to calculate hash of random bytes? What problem does it solve?
https://github.com/SK-EID/smart-id-documentation#611-sending-authentication-request

[jaanmurumets-sk]

It is needed to have secure anti-forgery solution, later that hash should be verified:
https://github.com/SK-EID/smart-id-documentation#613-verifying-the-authentication-response

We indeed should improve Smart-ID documentation should reasoning would be clear.
Similar solution is used in many solutions, for example OpenID connect:
https://developers.google.com/identity/protocols/OpenIDConnect

1. Create an anti-forgery state token
   You must protect the security of your users by preventing request forgery attacks. The first step is creating a unique session token that holds state between your app and the user's client. You later match this unique session token with the authentication response returned by the Google OAuth Login service to verify that the user is making the request and not a malicious attacker. These tokens are often referred to as cross-site request forgery (CSRF) tokens.

[Dissimilis]

I think you misunderstood my question.
You provided example which generates cryptographically secure 64 bytes. And then, as a next step, you calculate SHA512 of those random bytes. Which is confusing because it's not clear what is the purpose of hashing random bytes.

Also the use of term "randomly generated hash" in your documentation ads more confusion. It's should be either "randomly generated bytes" or "hash of something". Please explain the logic behind "randomly generated hash".

[martinpaljak]

Maybe it helps a bit if the random generator is not-that-good-and-random-at-all ?

[Dissimilis]

@martinpaljak In the example it uses SecureRandom so your argument is not valid. And even if RNG function would be totally deterministic, hashing the output would hardly be helpful.
And in this case I see it like this:
You need 64 random bytes, you call SecureRandom which with the help of OS and hardware does it's best to generate unpredictable bytes. Then you feed the resulting bytes to some hash function possibly destroying all the entropy you got.