If I understood correctly, instead of storing the full hash value, you just store 2-byte. As always, we assume that the attacker has the random chunk information, too. It will be very easy to find a collision since your truncated hash contains only $2$-byte $= 16$-bit. By the [birthday attack][1] on hash functions, the attacker only needs to try $\sqrt{2^{16}}= 2^8 = 256$ different files to has a collision with 50% probability. You can also see this questions and answers for truncated hash values; - [What are the consequences of removing a single byte from a sha256 hash?][2] - [Is truncating a SHA512 hash to the first 160 bits as secure as using SHA1?][3] [1]: https://en.wikipedia.org/wiki/Birthday_attack [2]: https://crypto.stackexchange.com/a/64315/18298 [3]: https://crypto.stackexchange.com/questions/9435/is-truncating-a-sha512-hash-to-the-first-160-bits-as-secure-as-using-sha1?noredirect=1&lq=1