Background: I'm developing an app that is based around registered users voting on stuff, and I want to create a heuristic that involves IP addresses as one way to flag accounts for further investigation of potential multiple account+vote abuse. In the interests of privacy/data minimization/GDPR obligations, it appears the best strategy is to store keyed hashes of the IPs, which would be sufficiently pseudonymous but deterministic for checking matches. So I could just use HMAC-SHA256 or similar on the whole address and be done with it.
However it occurs to me that it might be useful to not only identify IPs which are identical to each other, but also those that share a subnet, which would require something not quite so opaque. The obvious way to do this would be to hash each part of the IP separately. The problem is that with HMAC-SHA256 (for example) the complete output is just way too large, especially for IPv6 addresses (8 x 256 = 2048 bits for each 128-bit address). It would also cut down the size of the input space substantially (1-byte values for IPv4, 2-byte values for IPv6) - I assume it would be best to use a different key for each part if I were to do this, which doesn't sound fun.
What's a good way to achieve my goal while keeping the stored size relatively small? Maybe it's ok to truncate the output when using SHA256? Maybe since it's an HMAC and the key is secret it's ok to use a smaller and weaker hashing function in the first place like MD5? Maybe there's another hash function that is uniquely suited to this kind of use case? Any guidance is appreciated.