collision resistant summarizer for long hash values

Question

how we can summarize SHA-256 into shorter values when we for example can't handle more than 128 bits on system? its better just use first 128bit and ignore the rest of bits or split full value and XOR them? or use another hash function that produce required bit long hashes to generate a hash from SHA-256's value (e.g SHA-1)? which way is more robust and unpredictable?

Answer 1

The answer is "any sane summarization function is about as good as any other; pick whichever is convenient"

To the best of our knowledge, SHA-256 acts pretty much like a random function (except for the length extension attack; that wouldn't apply here)

So, the output of SHA-256 is essentially a random 256 bit number; so, if we have a 128 bit hash function:

Hash(M) = Summarize(SHA256(M))

then, as long as the Summarize function has $2^{128}$ preimages (of 256 bits) for each possible output (of 128 bits), it should be good. Both the "use the first 128 bits" and "split the full value and XOR them" functions have this property.

Now, since you talk about collision resistance, you can find a collision with a 128 bit hash function with about $O(2^{64})$ effort, by the simple expedient of generating $2^{64}$ random strings and hashing them, and then looking for two hashes with the same value (and, in case you're hoping the memory requirements of this would save you, there are clever ways to reduce the memory requirements drastically without requiring that much more computation time). As long as those random strings are longer than 128 bits, there's nothing a hash function can do to avoid a collision. If you need stronger collision resistance than that, you need to rethink the problem.

Also, since I mentioned the length extension attack, I'll summarize it here:

If you hash the value $SHA256(M)$, and the length of $M$, then you can compute a string $A$ such that, for any string $B$, you can compute the value:

SHA256(M | A | B)

You can compute this even though you know nothing more about $M$.

This wouldn't apply in this specific case, because for this to work, you need to know the entire $SHA256(M)$ output, and your summarize function will drop a lot (precisely 128 bits, actually) of that information.