The proposed 1024-bit hash
uberhash(message) = SHA-512(message) || SHA-512(message || "1")
is hardly more collision-resistant than SHA-512 is: an hypothetical collision of messages for SHA-512 (with messages of equal length, as all known collisions for the SHA familly and ancestors are) can be turned into (or already is) a collision for uberhash (if the collision for SHA-512 involves the last block, we simply extend the colliding messages with their padding).
A construction immune to this particular attack would be
uberhash2(message) = SHA-512( prefix0 || message ) || SHA-512( prefix1 || message )
(with prefix0
≠ prefix1
). But it is not demonstrably much more secure; see Antoine Joux: Multicollisions in Iterated Hash Functions. Application to Cascaded Constructions, in proceeding of Crypto 2004. That paper constructively proves that uberhash2 collision resistance can't be much more resistant than SHA-512 is to brute force attacks (that is, 256-bit).
On the other hand, uberhash2 seems to stand a fair chance of blocking extensions to SHA-512 of existing much-better-than-brute-force collision attacks against SHA-1 and ancestors (and that arguably could matter in practice). At least, even though MD5's collision resistance is hopelessly broken, I do not immediately see how to efficiently find a collision for
uberMD5(message) = MD5(prefix0 || message) || MD5(prefix1 || message)
Also, my reading is that the quoted paper does not rule out that concatenating $n$ secure $k$-bit different hashes might have $(n-1)k/2$-bit security.
I pass at how uberhash2 improves resistance to brute force attack using a quantum computer.
More generally: SHA-512 internal parameters (such as internal state size and number of rounds) are carefully chosen with 256-bit security in mind, and getting true 512-bit security with an argument about that would require increasing these parameters.
shake
functions. They are hash functions with arbitrary length outputs $\endgroup$ – Node.JS May 9 '17 at 3:11