If you want to use Skein (one of the SHA-3 candidates) anyway: it has a "mode of operation" (configuration variant) for tree hashing, which works just like your method 2. It does this internally of the operation, as multiple calls of *UBI* on the individual blocks. This is described in section 3.5.6 of the [Skein specification paper (version 1.3)][1]. ![skein tree hash example - from the paper][2] You will need a leaf-size of 1 MB (so, Y_l = 14, for the 512-bit variant, 15 for 256, 13 for 1024) and a maximum tree height Y_m = 2 for your application. (The image shows an example with Y_m >= 3.) The paper does not really include any cryptographic analysis of the tree hashing mode, but the fact that it is included (and even mentioned as a possible use for password hashing) seems to mean that the authors consider it at least as save as the "standard" sequential mode. (It is also not mentioned at all in the *[proof paper][3]*.) ----------- On a more theoretical level: Most ways of finding collisions in hash functions rely on finding a collision in the underlying compression function f : S × M -> S (which maps a previous state together with a block of data to the new state). A collision here is one of these: * a pair of messages and a state such that f(s, m1) = f(s, m2) * a pair of two states, a message block, so that f(s1, m) = f(s2, m) * a pair of messages and a pair of states such that f(s1, m1) = f(s2, m2). The first one is the easiest one to exploit - simply modify one block of your message, and let all the other blocks same. To use the other ones, we additionally need a preimage attack on the compression function for the previous blocks, which is usually thought to be even more complicated. If we have a collision of this first type, we can exploit it in the tree version just as well as in the sequential version, namely on the lowest level. For creating collisions on the higher levels, we again need preimage attacks on the lower levels. So, as long as the hash function (and its compression function) is preimage resistant, the tree version has not more collision weak points than the "long stream" one. [1]: http://www.skein-hash.info/sites/default/files/skein1.3.pdf [2]: https://i.sstatic.net/AVk36.png [3]: http://www.skein-hash.info/sites/default/files/skein-proofs.pdf