Building 256-hash function from known 64-bit hash functions

Question

There are 64-bit universal or almost universal hash functions, like CLHASH or VHASH:

https://arxiv.org/pdf/1503.03465.pdf

https://eprint.iacr.org/2007/338.pdf

Can we create secure 256-bit hash function by concatenation of this hash functions (by using different key for every function)? Similarly like authors of ECHO hash did based on AES (the only paper I found about this is "ASIC Evaluation of ECHO Hash Function").

In fact VHASH family has been proposed for cryptographic applications, and specifically message authentication VMAC:

https://en.wikipedia.org/wiki/VMAC

I think the same idea was behind CLHASH, because otherwise what is the point of proposing 64-bit hash function in 2015? But these functions seem to be very efficient, so why authors didn't go step further and did not propose 256-bit hash functions (especially computed in parallel), which may be then possibly in line with modern stardands of security?

Answer 1

Can we create secure 256-bit hash function by concatenation of this hash functions (by using different key for every function)?

Doesn't sound likely; the problem is that universal hash functions and cryptographical hash functions are very different things.

A universal hash function is a keyed function; its defining property is that for any two different messages, the universal hash function maps them to the same output for only a tiny subset of keys. That's it - that's the only property it needs to have. For one, there's nothing that says that, with a publicly known key, it has any security properties at all; it may be trivial to find preimages. In fact, for most known universal hash functions, this is quite easy.

In contrast, a cryptographical hash function is an unkeyed function - when someone computes it with a specific preimage, they can see everything that happens with it - that is, if there's a universal hash inside, they know the key to that universal hash. That voids any property we get from the universal hash (at least, as a universal hash).

Now, there might be universal hashes with additional properties - those might find a use within a cryptographical hash. However, just being a universal hash is insufficient.