I am looking to implement the Fortuna algorithm (https://www.schneier.com/fortuna.pdf) on a system with very restrictive memory constraints, using AES-128 as the underlying cipher.
As the key size is only 128 bits, using a 256-bit entropy pool hashing algorithm to maintain each pool would seem to be excessive (and a waste of memory). I would like to use a hashing algorithm for which I only need to maintain 128 bits of state information for each pool. Given this, I have a couple of questions:
Would it be possible to use something like SHA-256, but only save (and restore) 128 bits of the internal state between invocations? Would this somehow risk losing entropy in the process, or produce other undesirable effects?
Alternately, the crypto library I'm using also supports MD5, which does only require 128 bits of internal state. Would it be better to use MD5 for this application, despite its potential weaknesses compared to SHA-2 hashes, or would SHA-256 be stronger, even when maintaining only half its internal state between calls?