Say a Human is operating their trusted computer, Alice, and Human wants to hand copy a collision resistant commitment, with a security factor of 128 from Bob on to paper. Naturally we want the commitment written by Human to be of least entropy possible to reduce the chance for human error and carpal tunnel syndrome.
To accomplish this, Alice has Bob send her a 256-bit hash of the committed value. Then, Alice randomly generates (after receiving Bob's hash) a salt of size less than 128 bits (let's say 48), and appends that to Bob's 256-bit hash. Alice then takes a salted 128-bit hash of Bob's hash, and displays in human-friendly form the salt plus the 128-bit hash with a total entropy of 176 bits for Human to hand copy.
Assuming Alice is trusted, does this achieve 128-bit security with collision resistance, even if Bob learns the salt before revealing the commitment?
