I'm working on a forward secret messaging system that relies on hash ratchet. I'm using BLAKE2b as the one-way function, which by default produces 512-bit digests. These digests are truncated by my software to 256 bits using the
digest_size parameter of the Python implementation before they're used as key in XChaCha20-Poly1305. Using a simplified example, is
key = os.urandom(32) while True: ct = encrypt(key, input('Message: ')) key = blake2b(key, digest_size=32)
a secure construction, or does the key lose entropy with every ratchet step? If yes, should I use BLAKE2s instead?