Can it be proven that my home-brewed hash function is not LESS secure than a known good hash function it leverages?

Question

Home brewed cryptography is strongly discouraged because it is so easy to get it wrong.

Even if we leverage a known good hash function, one example, sha256, here by referred to as g() and use it in conjunction with a home-brew function b(), we can reduce our security because we have reduced our entropy; example:

g(b('secret')) will be less secure than just g('secret') if b() is collision prone.

Proving (I am not using prove in the strictest mathematical sense) a hash function is more secure than another is a herculean task that requires a lot of time from cryptography experts, and is beyond the scope of this question.

However, let's say no crypto-hash function that suits my needs currently implemented on my platform so I want to home-brew. If I am okay with worse performance, ect, and simply want to ensure it is not less secure than a known good function g() it leverages extensively.

For example, if we define b() to be g(g(g(g(g(g(g(g(g('secret'))))))))) we know that b() is not less secure than g()

Are there a set of quick set of guidelines that can be leveraged to ensure a derivative home-brew function is not less secure than the function it uses?

One example function b() might look something like this where it mainly uses a propriety logic as salt for g() (please do not think that this is intended as a replacement for random salt!!):

b() is defined as g('secret' + b1('secret'))

Answer 1

Yes, standard reduction proofs usually do the trick.

Reductions proofs usually work this way: Assume you can break property X of the new primitive, show how this capability (when used as black-box oracle) can be used to break property Y (with X=Y being allowed) on the old / standard primitive. Because property Y holds for the old primitive, you know also know property X holds for the new one by contraposition.

Concretely, you usually want at least collision resistance and preimage resistance.

So let's do an example with collision resistance:
Let $g(x)=f(x)\parallel h(x)$ with $f,g$ being collision resistant. We want to show that $g$ is collision resistant. Assume we have a collision on $g$, that is we know $x\neq x'$ such that $g(x)=g(x')$. Now by construction this means that $f(x)\parallel h(x)=f(x')\parallel h(x')$. Assuming $f$ has a fixed output length (as is usual with hashes), this means that $f(x)=f(x')$ needs to hold, but because we assumed $f$ to be collision resistant, this is clearly impossible and thus $g$ is collision resistant if $f$ is (actually $g$ is collision resistant if at least one of $f,h$ is, but this is about the basic principle).

As for $b(x):=g(x\parallel b_1(x))$, this is obviously collision resistant if $g$ is. Assume we knew $x\neq x'$ such that $b(x)=b(x')$, then we have $g(x\parallel b_1(x))=g(x'\parallel b_1(x'))$ but up to naming this is equivalent to saying $g(y)=g(y')$ which is a collision on $g$ if $y\neq y'$. Now because $y=x\parallel b_1(x)$ and $y'=x'\parallel b_1(x)$ with $x\neq x'$, clearly these are inequal because the leading part(s) consisting of $x$ and $x'$ are unequal. Thus we have constructed a collision on $g$ from a collision on $b$ and because $g$ is assumed to be collision resistant, this means that $b$ is as well.