# Taking half of a X bits hash key as secure as using a X/2 bit hash function?

This question comes from a (nitpicking) comment by me in this SO question.

I said that using the half of the output from a 256 bit hash function is worse than using a 128 bit hash function. My reasoning is that the contract of the 256 bit function takes into account the full length output so you can find more collisions in the first half of the 256 bits output than you would in a 128 bit hash function.

As I saw here Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1? that that could not be applied to SHA so I was wrong there but in a more broad scenario, does it provides the same security taking the half of the output from an X bit hash function than using a X/2 hash function?

• For the hashes we use in practice, truncation is safe. But it might be possible to construct pathological hashes where this is not the case. Commented Nov 24, 2015 at 8:51
• actually taking half the bits is probably much more secure than a smaller hash function, since you are now hiding a large amount of the hash state Commented Nov 24, 2015 at 9:57

For example, suppose you have a faster than $2^{128}$ second preimage attack on the 128-bit truncation of a 256-bit hash. Then you can run that attack $2^{128}$ times and expect to find a second preimage for some value of the full 256-bit hash, so that hash does not have 256-bit second preimage resistance (at least for some definitions of second preimage resistance).
However, the same argument does not apply to collision resistance: even if you can get a collision for the first half you need $2^{X/2}$ such pairs before you expect a collision in the second half. The birthday bound does not apply because you cannot compare different first-half collisions to each other.
(Collision resistance of the whole hash does put a bound on the multicollision resistance of the first half. If you had a $2^{X/4}$-collision in the first half, you would expect a collision among them in the second half.)