Suppose we need/prefer 128 bit hash output, for example to generate a 128 bit encryption key or, in other applications (e.g. file integrity verification), to consume less storage space.
I don't know of any new/standard/unbroken 128 bit hash function, so it seems we have to use SHA256.
Is truncating SHA256 output to 128 bits acceptable? Does such a truncated hash have a security equal to a 128 bit hash? I mean a 128 bit hash that has no known vulnerabilities; definitely not MD5!
I have an idea of how to accomplish this:
I don't know if this will have any benefit/detriment to security.